* [PATCH 5.15 000/846] 5.15.17-rc1 review
@ 2022-01-24 18:31 Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.15 001/846] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU Greg Kroah-Hartman
` (849 more replies)
0 siblings, 850 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
stable
This is the start of the stable review cycle for the 5.15.17 release.
There are 846 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Jan 2022 18:39:11 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.17-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.15.17-rc1
Andrey Konovalov <andreyknvl@gmail.com>
lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
Moshe Tal <moshet@nvidia.com>
bonding: Fix extraction of ports from the packet headers
Alistair Popple <apopple@nvidia.com>
mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault
Miaoqian Lin <linmq006@gmail.com>
lib82596: Fix IRQ check in sni_82596_probe
Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
scripts/dtc: dtx_diff: remove broken example from help text
Maxim Mikityanskiy <maximmi@nvidia.com>
sch_api: Don't skip qdisc attach on ingress
Sam Protsenko <semen.protsenko@linaro.org>
dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7
Alexander Stein <alexander.stein@mailbox.org>
dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
Alexander Stein <alexander.stein@mailbox.org>
dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property
Tom Rix <trix@redhat.com>
net: mscc: ocelot: fix using match before it is set
Claudiu Beznea <claudiu.beznea@microchip.com>
net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices
Ard Biesheuvel <ardb@kernel.org>
net: cpsw: avoid alignment faults by taking NET_IP_ALIGN into account
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: sfp: fix high power modules without diagnostic monitoring
Horatiu Vultur <horatiu.vultur@microchip.com>
net: ocelot: Fix the call to switchdev_bridge_port_offload
Tom Rix <trix@redhat.com>
net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()
Slark Xiao <slark_xiao@163.com>
net: wwan: Fix MRU mismatch issue which may lead to data connection lost
Sergey Shtylyov <s.shtylyov@omp.ru>
bcmgenet: add WOL IRQ check
Vladimir Oltean <vladimir.oltean@nxp.com>
net: mscc: ocelot: don't let phylink re-enable TX PAUSE on the NPI port
Kevin Bracey <kevin@bracey.fi>
net_sched: restore "mpu xxx" handling
Alex Elder <elder@linaro.org>
net: ipa: fix atomic update in ipa_endpoint_replenish()
Jie Wang <wangjie125@huawei.com>
net: bonding: fix bond_xmit_broadcast return value error bug
Miroslav Lichvar <mlichvar@redhat.com>
net: fix sock_timestamping_bind_phc() to release device
David Heidelberg <david@ixit.cz>
arm64: dts: qcom: msm8996: drop not documented adreno properties
Leon Romanovsky <leon@kernel.org>
devlink: Remove misleading internal_flags from health reporter dump
Zechuan Chen <chenzechuan1@huawei.com>
perf probe: Fix ppc64 'perf probe add events failed' case
Uwe Kleine-König <uwe@kleine-koenig.org>
perf tools: Drop requirement for libstdc++.so for libopencsd check
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Fix lld view setting
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Fix concurrency over xfers_list
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Print debug message after realeasing the lock
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Don't start transactions at tx_submit level
Adrian Hunter <adrian.hunter@intel.com>
perf script: Fix hex dump character output
Guillaume Nault <gnault@redhat.com>
libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
Guillaume Nault <gnault@redhat.com>
gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
Eli Cohen <elic@nvidia.com>
vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps()
Guillaume Nault <gnault@redhat.com>
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
Johannes Berg <johannes.berg@intel.com>
iwlwifi: fix Bz NMI behaviour
Eric Dumazet <edumazet@google.com>
netns: add schedule point in ops_exit_list()
Eric Dumazet <edumazet@google.com>
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
Eric W. Biederman <ebiederm@xmission.com>
taskstats: Cleanup the use of task->exit_code
Michael S. Tsirkin <mst@redhat.com>
virtio_ring: mark ring unused on error
Eli Cohen <elic@nvidia.com>
vdpa/mlx5: Fix wrong configuration of virtio_version_1_0
Laurence de Bruxelles <lfdebrux@gmail.com>
rtc: pxa: fix null pointer dereference
Dmitry Torokhov <dmitry.torokhov@gmail.com>
HID: vivaldi: fix handling devices not using numbered reports
Johannes Berg <johannes.berg@intel.com>
um: gitignore: Add kernel/capflags.c
Yury Norov <yury.norov@gmail.com>
bitops: protect find_first_{,zero}_bit properly
Robert Hancock <robert.hancock@calian.com>
net: axienet: increase default TX ring size to 128
Robert Hancock <robert.hancock@calian.com>
net: axienet: fix for TX busy handling
Robert Hancock <robert.hancock@calian.com>
net: axienet: fix number of TX ring slots for available check
Robert Hancock <robert.hancock@calian.com>
net: axienet: Fix TX ring slot available check
Robert Hancock <robert.hancock@calian.com>
net: axienet: limit minimum TX ring size
Robert Hancock <robert.hancock@calian.com>
net: axienet: add missing memory barriers
Robert Hancock <robert.hancock@calian.com>
net: axienet: reset core on initialization prior to MDIO access
Robert Hancock <robert.hancock@calian.com>
net: axienet: Wait for PhyRstCmplt after core reset
Robert Hancock <robert.hancock@calian.com>
net: axienet: increase reset timeout
Wen Gu <guwen@linux.alibaba.com>
net/smc: Fix hung_task when removing SMC-R devices
Miaoqian Lin <linmq006@gmail.com>
gpio: idt3243x: Fix IRQ check in idt_gpio_probe
Miaoqian Lin <linmq006@gmail.com>
gpio: mpc8xxx: Fix IRQ check in mpc8xxx_probe
John Keeping <john@metanate.com>
pinctrl/rockchip: fix gpio device creation
Robert Hancock <robert.hancock@calian.com>
clk: si5341: Fix clock HW provider cleanup
Stephen Boyd <sboyd@kernel.org>
clk: Emit a stern warning with writable debugfs enabled
Eric Dumazet <edumazet@google.com>
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
Dan Carpenter <dan.carpenter@oracle.com>
crypto: octeontx2 - uninitialized variable in kvf_limits_store()
Chao Yu <chao@kernel.org>
f2fs: fix to check available space of CP area correctly in update_ckpt_flags()
Chao Yu <chao@kernel.org>
f2fs: fix to reserve space for IO align feature
Hyeong-Jun Kim <hj514.kim@samsung.com>
f2fs: compress: fix potential deadlock of compress file
Chao Yu <chao@kernel.org>
f2fs: fix to avoid panic in is_alive() if metadata is inconsistent
Fengnan Chang <changfengnan@vivo.com>
f2fs: fix remove page failed in invalidate compress pages
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Remove unused compile options
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Remove explicit transparent hugepages support
Geert Uytterhoeven <geert@linux-m68k.org>
riscv: dts: microchip: mpfs: Drop empty chosen node
Miaoqian Lin <linmq006@gmail.com>
parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
Tobias Waldekranz <tobias@waldekranz.com>
net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
Tobias Waldekranz <tobias@waldekranz.com>
net/fsl: xgmac_mdio: Add workaround for erratum A-009885
Guillaume Nault <gnault@redhat.com>
mlx5: Don't accidentally set RTO_ONLINK before mlx5e_route_lookup_ipv4_get()
Eric Dumazet <edumazet@google.com>
ipv4: avoid quadratic behavior in netns dismantle
Eric Dumazet <edumazet@google.com>
ipv4: update fib_info_cnt under spinlock protection
German Gomez <german.gomez@arm.com>
perf evsel: Override attr->sample_period for non-libpfm4 events
Daniel Borkmann <daniel@iogearbox.net>
bpf: Mark PTR_TO_FUNC register initially with zero offset
Yafang Shao <laoar.shao@gmail.com>
bpf: Fix mount source show for bpffs
Toke Høiland-Jørgensen <toke@redhat.com>
xdp: check prog type before updating BPF link
Quentin Monnet <quentin@isovalent.com>
bpftool: Fix indent in option lists in the documentation
Quentin Monnet <quentin@isovalent.com>
bpftool: Remove inclusion of utilities.mak from Makefiles
Russell King <russell.king@oracle.com>
arm64/bpf: Remove 128MB limit for BPF JIT programs
Maxime Ripard <maxime@cerno.tech>
drm/vc4: crtc: Copy assigned channel to the CRTC
Maxime Ripard <maxime@cerno.tech>
drm/vc4: Fix non-blocking commit getting stuck forever
Maxime Ripard <maxime@cerno.tech>
drm/vc4: crtc: Drop feed_txp from state
Ye Bin <yebin10@huawei.com>
block: Fix fsync always failed if once failed
Jens Axboe <axboe@kernel.dk>
block: fix async_depth sysfs interface for mq-deadline
Tobias Waldekranz <tobias@waldekranz.com>
powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
Anders Roxell <anders.roxell@linaro.org>
powerpc/cell: Fix clang -Wimplicit-fallthrough warning
Moshe Shemesh <moshe@nvidia.com>
Revert "net/mlx5: Add retry mechanism to the command entry index allocation"
Amelie Delaunay <amelie.delaunay@foss.st.com>
dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
Chengguang Xu <cgxu519@mykernel.net>
RDMA/rxe: Fix a typo in opcode name
Yixing Liu <liuyixing1@huawei.com>
RDMA/hns: Modify the mapping attribute of doorbell to device
Dave Jiang <dave.jiang@intel.com>
dmaengine: idxd: fix wq settings post wq disable
Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
dmaengine: uniphier-xdmac: Fix type of address variables
Håkon Bugge <haakon.bugge@oracle.com>
RDMA/cma: Remove open coding of overflow checking for private_data_len
Miaoqian Lin <linmq006@gmail.com>
scsi: ufs: ufs-mediatek: Fix error checking in ufs_mtk_init_va09_pwr_ctrl()
Bart Van Assche <bvanassche@acm.org>
scsi: core: Show SCMD_LAST in text form
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_sync: Fix not setting adv set duration
Markus Reichl <m.reichl@fivetechno.de>
net: usb: Correct reset handling of smsc95xx
Mark Chen <mark-yw.chen@mediatek.com>
Bluetooth: btusb: Return error code when getting patch status failed
Randy Dunlap <rdunlap@infradead.org>
Documentation: fix firewire.rst ABI file path error
Lukas Bulwahn <lukas.bulwahn@gmail.com>
Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
Alexandre Ghiti <alexandre.ghiti@canonical.com>
Documentation, arch: Remove leftovers from CIFS_WEAK_PW_HASH
Alexandre Ghiti <alexandre.ghiti@canonical.com>
Documentation, arch: Remove leftovers from raw device
Sakari Ailus <sakari.ailus@linux.intel.com>
Documentation: ACPI: Fix data node reference documentation
Daniel Thompson <daniel.thompson@linaro.org>
Documentation: dmaengine: Correctly describe dmatest with channel unset
Mike Leach <mike.leach@linaro.org>
Documentation: coresight: Fix documentation issue
Randy Dunlap <rdunlap@infradead.org>
media: correct MEDIA_TEST_SUPPORT help text
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Make sure the device is powered with CEC
Suresh Udipi <sudipi@jp.adit-jv.com>
media: rcar-csi2: Optimize the selection PHTW register
Marc Kleine-Budde <mkl@pengutronix.de>
can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message
Ben Hutchings <ben@decadent.org.uk>
firmware: Update Kconfig help text for Google firmware
Baruch Siach <baruch@tkos.co.il>
of: base: Improve argument length mismatch error
Christian König <christian.koenig@amd.com>
drm/radeon: fix error handling in radeon_driver_open_kms
Rajneesh Bhardwaj <rajneesh.bhardwaj@amd.com>
Revert "drm/amdgpu: Don't inherit GEM object VMAs in child process"
Aaron Ma <aaron.ma@canonical.com>
ath11k: qmi: avoid error messages when dma allocation fails
Nikita Yushchenko <nikita.yushchenko@virtuozzo.com>
tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails
Theodore Ts'o <tytso@mit.edu>
ext4: don't use the orphan list when migrating an inode
Zhang Yi <yi.zhang@huawei.com>
ext4: fix an use-after-free issue about data=journal writeback mode
Ye Bin <yebin10@huawei.com>
ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal
Xin Yin <yinxin.x@bytedance.com>
ext4: fast commit may miss tracking unwritten range during ftruncate
Xin Yin <yinxin.x@bytedance.com>
ext4: use ext4_ext_remove_space() for fast commit replay delete range
Ye Bin <yebin10@huawei.com>
ext4: Fix BUG_ON in ext4_bread when write quota data
Luís Henriques <lhenriques@suse.de>
ext4: set csum seed in tmp inode while migrating to extents
Xin Yin <yinxin.x@bytedance.com>
ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE
Harshad Shirwadkar <harshadshirwadkar@gmail.com>
ext4: initialize err_blk before calling __ext4_get_inode_loc
Chunguang Xu <brookxu@tencent.com>
ext4: fix a possible ABBA deadlock due to busy PA
Jan Kara <jack@suse.cz>
ext4: make sure quota gets properly shutdown on error
Jan Kara <jack@suse.cz>
ext4: make sure to reset inode lockdep class when quota enabling fails
Filipe Manana <fdmanana@suse.com>
btrfs: respect the max size in the header when activating swap file
Josef Bacik <josef@toxicpanda.com>
btrfs: check the root node for uptodate before returning it
Filipe Manana <fdmanana@suse.com>
btrfs: fix deadlock between quota enable and other quota operations
Nicolas Dichtel <nicolas.dichtel@6wind.com>
xfrm: fix dflt policy check when there is no policy configured
Ghalem Boudour <ghalem.boudour@6wind.com>
xfrm: fix policy lookup for ipv6 gre packets
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Correctly set PCIe capabilities
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Fix definitions of reserved bits
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only
Lukas Wunner <lukas@wunner.de>
PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
Hans de Goede <hdegoede@redhat.com>
PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors
Rob Herring <robh@kernel.org>
PCI: xgene: Fix IB window setup
José Roberto de Souza <jose.souza@intel.com>
drm/i915/display/ehl: Update voltage swing table
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu: don't do resets on APUs which don't support it
James Smart <jsmart2021@gmail.com>
scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance
Nicholas Piggin <npiggin@gmail.com>
powerpc/64s/radix: Fix huge vmap false positive
John David Anglin <dave.anglin@bell.net>
parisc: Fix lpa and lpa_user defines
Brian Norris <briannorris@chromium.org>
drm/bridge: analogix_dp: Make PSR-exit block less
Ilia Mirkin <imirkin@alum.mit.edu>
drm/nouveau/kms/nv04: use vzalloc for nv04_display
Yizhuo Zhai <yzhai003@ucr.edu>
drm/amd/display: Fix the uninitialized variable in enable_stream_features()
Lucas Stach <l.stach@pengutronix.de>
drm/etnaviv: limit submit sizes
Dmitry Osipenko <digetx@gmail.com>
drm/tegra: submit: Add missing pm_runtime_mark_last_busy()
Sakari Ailus <sakari.ailus@linux.intel.com>
device property: Fix fwnode_graph_devcon_match() fwnode leak
Alexander Gordeev <agordeev@linux.ibm.com>
s390/mm: fix 2KB pgtable release race
Ilan Peer <ilan.peer@intel.com>
iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
remoteproc: imx_rproc: Fix a resource leak in the remove function
Steven Rostedt <rostedt@goodmis.org>
tracing: Have syscall trace events use trace_event_buffer_lock_reserve()
Xiangyang Zhang <xyz.sun.ok@gmail.com>
tracing/kprobes: 'nmissed' not showed correctly for kretprobe
Andrey Ryabinin <arbn@yandex-team.com>
sched/cpuacct: Fix user/system in shown cpuacct.usage*
Andrey Ryabinin <arbn@yandex-team.com>
cputime, cpuacct: Include guest time in user time in cpuacct.stat
Lukas Wunner <lukas@wunner.de>
serial: Fix incorrect rs485 polarity on uart open
Xie Yongji <xieyongji@bytedance.com>
fuse: Pass correct lend value to filemap_write_and_wait_range()
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
HID: magicmouse: Fix an error handling path in magicmouse_probe()
Xiao Ni <xni@redhat.com>
md: Move alloc/free acct bioset in to personality
Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
xen/gntdev: fix unmap notification order
Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
spi: uniphier: Fix a bug that doesn't point to private data correctly
Dmitry Osipenko <digetx@gmail.com>
mfd: tps65910: Set PWR_OFF bit during driver probe
Patrick Williams <patrick@stwcx.xyz>
tpm: fix NPE on probe for missing device
Lino Sanfilippo <LinoSanfilippo@gmx.de>
tpm: fix potential NULL pointer access in tpm_del_char_device
Petr Cvachoucek <cvachoucek@gmail.com>
ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
Meng Li <Meng.Li@windriver.com>
crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
Marek Vasut <marex@denx.de>
crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
Heiner Kallweit <hkallweit1@gmail.com>
crypto: omap-aes - Fix broken pm_runtime_and_get() usage
Zhu Lingshan <lingshan.zhu@intel.com>
ifcvf/vDPA: fix misuse virtio-net device config size for blk dev
Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
rpmsg: core: Clean up resources on announce_create failure.
Andrew Lunn <andrew@lunn.ch>
udp6: Use Segment Routing Header for dest address if present
Andrew Lunn <andrew@lunn.ch>
icmp: ICMPV6: Examine invoking packet for Segment Route Headers.
Andrew Lunn <andrew@lunn.ch>
seg6: export get_srh() for ICMP handling
Conor Dooley <conor.dooley@microchip.com>
mailbox: change mailbox-mpfs compatible string
Miaoqian Lin <linmq006@gmail.com>
phy: mediatek: Fix missing check in mtk_mipi_tx_probe
Ohad Sharabi <osharabi@habana.ai>
habanalabs: skip read fw errors if dynamic descriptor invalid
Tzung-Bi Shih <tzungbi@google.com>
ASoC: mediatek: mt8183: fix device_node leak
Tzung-Bi Shih <tzungbi@google.com>
ASoC: mediatek: mt8173: fix device_node leak
Chunfeng Yun <chunfeng.yun@mediatek.com>
phy: phy-mtk-tphy: add support efuse setting
Tzung-Bi Shih <tzungbi@google.com>
ASoC: mediatek: mt8192-mt6359: fix device_node leak
Sreekanth Reddy <sreekanth.reddy@broadcom.com>
scsi: mpi3mr: Fixes around reply request queues
Christoph Hellwig <hch@lst.de>
scsi: sr: Don't use GFP_DMA
Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
MIPS: Octeon: Fix build errors using clang
Michael Ellerman <mpe@ellerman.id.au>
selftests/powerpc: Add a test of sigreturning to the kernel
Lakshmi Sowjanya D <lakshmi.sowjanya.d@intel.com>
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
Marc Zyngier <maz@kernel.org>
irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time
Ye Guojin <ye.guojin@zte.com.cn>
MIPS: OCTEON: add put_device() after of_find_device_by_node()
Jan Kara <jack@suse.cz>
udf: Fix error handling in udf_new_inode()
Hari Bathini <hbathini@linux.ibm.com>
powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic
Hari Bathini <hbathini@linux.ibm.com>
powerpc: handle kdump appropriately with crash_kexec_post_notifiers option
Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
selftests/powerpc/spectre_v2: Return skip code when miss_percent is high
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/40x: Map 32Mbytes of memory at startup
Nathan Chancellor <nathan@kernel.org>
MIPS: Loongson64: Use three arguments for slti
Takashi Iwai <tiwai@suse.de>
ALSA: seq: Set upper limit of processed events
James Smart <jsmart2021@gmail.com>
scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup
James Smart <jsmart2021@gmail.com>
scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV
Bart Van Assche <bvanassche@acm.org>
scsi: ufs: Fix a kernel crash during shutdown
Stephan Gerhold <stephan@gerhold.net>
interconnect: qcom: rpm: Prevent integer overflow in rate
Christoph Hellwig <hch@lst.de>
dm: fix alloc_dax error handling in alloc_dev
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
nvmem: core: set size for sysfs bin file
Christophe Leroy <christophe.leroy@csgroup.eu>
w1: Misuse of get_user()/put_user() reported by sparse
Alexey Kardashevskiy <aik@ozlabs.ru>
KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST
Alexey Kardashevskiy <aik@ozlabs.ru>
KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/powermac: Add missing lockdep_register_key()
Martin Blumenstingl <martin.blumenstingl@googlemail.com>
clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB
Joakim Tjernlund <joakim.tjernlund@infinera.com>
i2c: mpc: Correct I2C reset procedure
Michael Ellerman <mpe@ellerman.id.au>
powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
Heiner Kallweit <hkallweit1@gmail.com>
i2c: i801: Don't silently correct invalid transfer size
Ye Guojin <ye.guojin@zte.com.cn>
ASoC: imx-hdmi: add put_device() after of_find_device_by_node()
Nicholas Piggin <npiggin@gmail.com>
powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
Julia Lawall <Julia.Lawall@lip6.fr>
powerpc/btext: add missing of_node_put
Julia Lawall <Julia.Lawall@lip6.fr>
powerpc/cell: add missing of_node_put
Julia Lawall <Julia.Lawall@lip6.fr>
powerpc/powernv: add missing of_node_put
Julia Lawall <Julia.Lawall@lip6.fr>
powerpc/6xx: add missing of_node_put
Ingo Molnar <mingo@kernel.org>
x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs
Marc Kleine-Budde <mkl@pengutronix.de>
can: flexcan: add more quirks to describe RX path capabilities
Marc Kleine-Budde <mkl@pengutronix.de>
can: flexcan: rename RX modes
Dario Binacchi <dario.binacchi@amarulasolutions.com>
can: flexcan: allow to change quirks at runtime
Mauro Carvalho Chehab <mchehab@kernel.org>
scripts: sphinx-pre-install: Fix ctex support on Debian
John David Anglin <dave.anglin@bell.net>
parisc: Avoid calling faulthandler_disabled() twice
Maor Dickman <maord@nvidia.com>
net/mlx5e: Unblock setting vid 0 for VF in case PF isn't eswitch manager
Maher Sanalla <msanalla@nvidia.com>
net/mlx5: Update log_max_qp value to FW max capability
Jason A. Donenfeld <Jason@zx2c4.com>
random: do not throw away excess input to crng_fast_load
Lukas Wunner <lukas@wunner.de>
serial: core: Keep mctrl register state and cached copy in sync
Lukas Wunner <lukas@wunner.de>
serial: pl011: Drop CR register reset on set_termios
Lukas Wunner <lukas@wunner.de>
serial: pl010: Drop CR register reset on set_termios
Konrad Dybcio <konrad.dybcio@somainline.org>
regulator: qcom_smd: Align probe function with rpmh-regulator
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: gemini: allow any RGMII interface mode
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: phy: marvell: configure RGMII delays for 88E1118
Danielle Ratson <danieller@nvidia.com>
mlxsw: pci: Avoid flow control for EMAD packets
Jiri Olsa <jolsa@redhat.com>
bpf/selftests: Fix namespace mount setup in tc_redirect
Joe Thornber <ejt@redhat.com>
dm space map common: add bounds check to sm_ll_lookup_bitmap()
Joe Thornber <ejt@redhat.com>
dm btree: add a defensive bounds check to insert_at()
Ping-Ke Shih <pkshih@realtek.com>
mac80211: allow non-standard VHT MCS-10/11
Florian Fainelli <f.fainelli@gmail.com>
net: mdio: Demote probed message to debug print
Josef Bacik <josef@toxicpanda.com>
btrfs: remove BUG_ON(!eie) in find_parent_nodes
Josef Bacik <josef@toxicpanda.com>
btrfs: remove BUG_ON() in find_parent_nodes()
Mario Limonciello <mario.limonciello@amd.com>
ACPI: CPPC: Check present CPUs for determining _CPC is valid
Thomas Weißschuh <linux@weissschuh.net>
ACPI: battery: Add the ThinkPad "Not Charging" quirk
Marina Nikolic <Marina.Nikolic@amd.com>
amdgpu/pm: Make sysfs pm attributes as read-only for VFs
Zongmin Zhou <zhouzongmin@kylinos.cn>
drm/amdgpu: fixup bad vram size on gmc v8
Rajneesh Bhardwaj <rajneesh.bhardwaj@amd.com>
drm/amdgpu: Don't inherit GEM object VMAs in child process
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
Sudeep Holla <sudeep.holla@arm.com>
ACPICA: Fix wrong interpretation of PCC address
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPICA: Utilities: Avoid deleting the same object twice in a row
Mark Langsdorf <mlangsdo@redhat.com>
ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
Kyeong Yoo <kyeong.yoo@alliedtelesis.co.nz>
jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
Lucas Stach <l.stach@pengutronix.de>
drm/etnaviv: consider completed fence seqno in hang check
Antony Antony <antony.antony@secunet.com>
xfrm: rate limit SA mapping change message to user space
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES
Tedd Ho-Jeong An <tedd.an@intel.com>
Bluetooth: btintel: Add missing quirks and msft ext for legacy bootloader
Ben Greear <greearb@candelatech.com>
ath11k: Fix napi related hang
Randy Dunlap <rdunlap@infradead.org>
um: registers: Rename function names to avoid conflicts and build problems
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
block: check minor range in device_add_disk()
Hector Martin <marcan@marcan.st>
mmc: sdhci-pci-gli: GL9755: Support for CD/WP inversion on OF platforms
Luca Coelho <luciano.coelho@intel.com>
iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ
Avraham Stern <avraham.stern@intel.com>
iwlwifi: mvm: fix AUX ROC removal
Ilan Peer <ilan.peer@intel.com>
iwlwifi: mvm: Fix calculation of frame length
Johannes Berg <johannes.berg@intel.com>
iwlwifi: remove module loading failure message
Johannes Berg <johannes.berg@intel.com>
iwlwifi: fix leaks/bad data after failed firmware load
Changcheng Deng <deng.changcheng@zte.com.cn>
PM: AVS: qcom-cpr: Use div64_ul instead of do_div
Po-Hao Huang <phhuang@realtek.com>
rtw88: 8822c: update rx settings to prevent potential hw deadlock
Zekun Shen <bruceshenzk@gmail.com>
ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep()
Felix Fietkau <nbd@nbd.name>
mt76: mt7615: improve wmm index allocation
Xing Song <xing.song@mediatek.com>
mt76: do not pass the received frame with decryption error
Peter Chiu <chui-hao.chiu@mediatek.com>
mt76: mt7615: fix possible deadlock while mt7615_register_ext_phy()
Kai-Heng Feng <kai.heng.feng@canonical.com>
usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
cpufreq: Fix initialization of min and max frequency QoS requests
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
PM: runtime: Add safety net to supplier device release
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/hpre - fix memory leak in hpre_curve25519_src_init()
Peter Gonda <pgonda@google.com>
crypto: ccp - Move SEV_INIT retry for corrupted data
Thierry Reding <treding@nvidia.com>
arm64: tegra: Adjust length of CCPLEX cluster MMIO region
Biwen Li <biwen.li@nxp.com>
arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus
Paul Moore <paul@paul-moore.com>
audit: ensure userspace is penalized the same as the kernel when under pressure
Jingwen Chen <Jingwen.Chen2@amd.com>
drm/amd/amdgpu: fix gmc bo pin count leak in SRIOV
Jingwen Chen <Jingwen.Chen2@amd.com>
drm/amd/amdgpu: fix psp tmr bo pin count leak in SRIOV
Ulf Hansson <ulf.hansson@linaro.org>
mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
Biju Das <biju.das.jz@bp.renesas.com>
mmc: tmio: reinit card irqs in reset routine
Zhou Qingyang <zhou1615@umn.edu>
media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
Mikhail Rudenko <mike.rudenko@gmail.com>
media: rockchip: rkisp1: use device name for debugfs subdir name
Sean Young <sean@mess.org>
media: igorplugusb: receiver overflow should be reported
Alistair Francis <alistair@alistair23.me>
HID: i2c-hid-of: Expose the touchscreen-inverted properties
Alistair Francis <alistair@alistair23.me>
HID: quirks: Allow inverting the absolute X/Y values
Felix Kuehling <Felix.Kuehling@amd.com>
drm/amdkfd: Fix error handling in svm_range_add
Paolo Abeni <pabeni@redhat.com>
bpf: Do not WARN in bpf_warn_invalid_xdp_action()
David Gow <davidgow@google.com>
kunit: Don't crash if no parameters are generated
Suresh Kumar <surkumar@redhat.com>
net: bonding: debug: avoid printing debug logs when bond is not notifying peers
Borislav Petkov <bp@suse.de>
x86/mce: Mark mce_read_aux() noinstr
Borislav Petkov <bp@suse.de>
x86/mce: Mark mce_end() noinstr
Borislav Petkov <bp@suse.de>
x86/mce: Mark mce_panic() noinstr
Borislav Petkov <bp@suse.de>
x86/mce: Allow instrumentation during task work queueing
Alex Elder <elder@linaro.org>
ARM: dts: qcom: sdx55: fix IPA interconnect definitions
Baochen Qiang <quic_bqiang@quicinc.com>
ath11k: Avoid false DEADLOCK warning reported by lockdep
Heiko Carstens <hca@linux.ibm.com>
selftests/ftrace: make kprobe profile testcase description unique
Iwona Winiarska <iwona.winiarska@intel.com>
gpio: aspeed-sgpio: Convert aspeed_sgpio.lock to raw_spinlock
Iwona Winiarska <iwona.winiarska@intel.com>
gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: phy: prefer 1000baseT over 1000baseKX
Antoine Tenart <atenart@kernel.org>
net-sysfs: update the queue counts in the unregistration path
Sebastian Gottschall <s.gottschall@dd-wrt.com>
ath10k: Fix tx hanging
Wen Gong <quic_wgong@quicinc.com>
ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work
Wander Lairson Costa <wander@redhat.com>
rcutorture: Avoid soft lockup during cpu stall
Shaul Triebitz <shaul.triebitz@intel.com>
iwlwifi: mvm: avoid clearing a just saved session protection id
Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: synchronize with FW after multicast commands
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
arm64: dts: renesas: Fix thermal bindings
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Runtime PM activate both ends of the device link
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: m920x: don't use stack on USB reads
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix "variable dereferenced before check 'asd'"
Zhou Qingyang <zhou1615@umn.edu>
media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
media: rcar-vin: Update format alignment constraints
James Hilliard <james.hilliard1@gmail.com>
media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
drm: rcar-du: Fix CRTC timings when CMM is used
Joerg Roedel <jroedel@suse.de>
x86/mm: Flush global TLB when switching to trampoline page-table
Xiongwei Song <sxwjean@gmail.com>
floppy: Add max size check for user space request
Neal Liu <neal_liu@aspeedtech.com>
usb: uhci: add aspeed ast2600 uhci support
Kishon Vijay Abraham I <kishon@ti.com>
arm64: dts: ti: j721e-main: Fix 'dtbs_check' in serdes_ln_ctrl node
Kishon Vijay Abraham I <kishon@ti.com>
arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node
Hans de Goede <hdegoede@redhat.com>
ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win
Hans de Goede <hdegoede@redhat.com>
ACPI / x86: Allow specifying acpi_device_override_status() quirks by path
Hans de Goede <hdegoede@redhat.com>
ACPI: Change acpi_device_always_present() into acpi_device_override_status()
Hans de Goede <hdegoede@redhat.com>
ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Introduce a new placement for MOB page tables
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Release ttm memory if probe fails
Adam Ward <Adam.Ward.opensource@diasemi.com>
regulator: da9121: Prevent current limit change when enabled
Mansur Alisha Shaik <mansur@codeaurora.org>
media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions
Sriram R <quic_srirrama@quicinc.com>
ath11k: Avoid NULL ptr access during mgmt tx cleanup
Zekun Shen <bruceshenzk@gmail.com>
rsi: Fix out-of-bounds read in rsi_read_pkt()
Zekun Shen <bruceshenzk@gmail.com>
rsi: Fix use-after-free in rsi_rx_done_handler()
Zekun Shen <bruceshenzk@gmail.com>
mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
Stephan Müller <smueller@chronox.de>
crypto: jitter - consider 32 LSB for APT
Chengfeng Ye <cyeaa@connect.ust.hk>
HSI: core: Fix return freed object in hsi_new_client
Hans de Goede <hdegoede@redhat.com>
gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
Fugang Duan <fugang.duan@nxp.com>
tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown()
Jiri Slaby <jirislaby@kernel.org>
mxser: keep only !tty test in ISR
Martyn Welch <martyn.welch@collabora.com>
drm/bridge: megachips: Ensure both bridges are probed before registration
Martin Leung <Martin.Leung@amd.com>
drm/amd/display: add else to avoid double destroy clk_mgr
Danielle Ratson <danieller@nvidia.com>
mlxsw: pci: Add shutdown method in PCI driver
Jan Kiszka <jan.kiszka@siemens.com>
soc: ti: pruss: fix referenced node in error message
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/display: set vblank_disable_immediate for DC
Yang Li <yang.lee@linux.alibaba.com>
drm/amd/display: check top_pipe_to_program pointer
Lukas Bulwahn <lukas.bulwahn@gmail.com>
ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART
Marek Vasut <marex@denx.de>
soc: imx: gpcv2: Synchronously suspend MIX domains
Konrad Dybcio <konrad.dybcio@somainline.org>
arm64: dts: qcom: sm8350: Shorten camera-thermal-bottom name
Dinh Nguyen <dinguyen@kernel.org>
EDAC/synopsys: Use the quirk for version instead of ddr version
Yang Li <yang.lee@linux.alibaba.com>
ethernet: renesas: Use div64_ul instead of do_div
Andrii Nakryiko <andrii@kernel.org>
libbpf: Accommodate DWARF/compiler bug with duplicated structs
Zheyu Ma <zheyuma97@gmail.com>
media: b2c2: Add missing check in flexcop_pci_isr:
José Expósito <jose.exposito89@gmail.com>
HID: apple: Do not reset quirks when the Fn key is not found
José Expósito <jose.exposito89@gmail.com>
HID: magicmouse: Report battery level over USB
Hans de Goede <hdegoede@redhat.com>
drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
Brian Chen <brianchen118@gmail.com>
psi: Fix PSI_MEM_FULL state when tasks are in memstall and doing reclaim
Pavankumar Kondeti <quic_pkondeti@quicinc.com>
usb: gadget: f_fs: Use stream_open() for endpoint files
Haimin Zhang <tcs.kernel@gmail.com>
USB: ehci_brcm_hub_control: Improve port index sanitizing
Amjad Ouled-Ameur <aouledameur@baylibre.com>
usb: dwc3: meson-g12a: fix shared reset control use
Baochen Qiang <bqiang@codeaurora.org>
ath11k: Fix crash caused by uninitialized TX ring
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: handle errors at sh_css_create_isp_params()
Linus Lüssing <linus.luessing@c0d3.blue>
batman-adv: allow netlink usage in unprivileged containers
Wan Jiabing <wanjiabing@vivo.com>
ARM: shmobile: rcar-gen2: Add missing of_node_put()
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: check before deference asd variable
Hans de Goede <hdegoede@redhat.com>
media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: set per-device's default mode
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: fix try_fmt logic
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
Neil Armstrong <narmstrong@baylibre.com>
drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR
Zekun Shen <bruceshenzk@gmail.com>
ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: Fix bpf_object leak in skb_ctx selftest
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: Destroy XDP link correctly
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: Fix memory leaks in btf_type_c_dump() helper
Qiang Yu <yuq825@gmail.com>
drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y
Andrii Nakryiko <andrii@kernel.org>
libbpf: Validate that .BTF and .BTF.ext sections contain data
Alexander Aring <aahringo@redhat.com>
fs: dlm: filter user dlm messages for kernel locks
Archie Pusaka <apusaka@chromium.org>
Bluetooth: Fix removing adv when processing cmd complete
Brian Norris <briannorris@chromium.org>
drm/panel: Delete panel on mipi_dsi_attach() failure
Wei Yongjun <weiyongjun1@huawei.com>
Bluetooth: Fix memory leak of hci device
Wei Yongjun <weiyongjun1@huawei.com>
Bluetooth: Fix debugfs entry leak in hci_register_dev()
Merlijn Wajer <merlijn@wizzup.org>
leds: lp55xx: initialise output direction from dts
Sicelo A. Mhlongo <absicsz@gmail.com>
ARM: dts: omap3-n900: Fix lp5523 for multi color
jason-jh.lin <jason-jh.lin@mediatek.com>
mailbox: fix gce_num of mt8192 driver data
Paul Cercueil <paul@crapouillou.net>
MIPS: compressed: Fix build with ZSTD compression
Paul Cercueil <paul@crapouillou.net>
MIPS: boot/compressed/: add __ashldi3 to target for ZSTD compression
Stephen Boyd <swboyd@chromium.org>
of/fdt: Don't worry about non-memory region overlap for no-map
Baruch Siach <baruch@tkos.co.il>
of: base: Fix phandle argument length mismatch error message
Conor Dooley <conor.dooley@microchip.com>
clk: bm1880: remove kfrees on static allocations
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: fsl_asrc: refine the check of available clock divider
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: imx-card: improve the sound quality for low rate
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: imx-card: Fix mclk calculation issue for akcodec
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: imx-card: Need special setting for ak4497 on i.MX8MQ
Taniya Das <tdas@codeaurora.org>
clk: qcom: gcc-sc7280: Mark gcc_cfg_noc_lpass_clk always enabled
Kamal Heib <kamalheib1@gmail.com>
RDMA/cxgb4: Set queue pair state when being queried
Christian A. Ehrhardt <lk@c--e.de>
ALSA: hda/cs8409: Fix Jack detection after resume
Christian A. Ehrhardt <lk@c--e.de>
ALSA: hda/cs8409: Increase delay during jack detection
Alyssa Ross <hi@alyssa.is>
ASoC: fsl_mqs: fix MODULE_ALIAS
Ammar Faizi <ammarfaizi2@gmail.com>
powerpc/xive: Add missing null check after calling kmalloc
Randy Dunlap <rdunlap@infradead.org>
mips: bcm63xx: add support for clk_set_parent()
Randy Dunlap <rdunlap@infradead.org>
mips: lantiq: add support for clk_set_parent()
Sameer Pujar <spujar@nvidia.com>
arm64: tegra: Remove non existent Tegra194 reset
Trevor Wu <trevor.wu@mediatek.com>
ASoC: mediatek: mt8195: correct pcmif BE dai control flow
Wei Yongjun <weiyongjun1@huawei.com>
misc: lattice-ecp3-config: Fix task hung when firmware load failed
Jiasheng Jiang <jiasheng@iscas.ac.cn>
ASoC: samsung: idma: Check of ioremap return value
Swapnil Jakhade <sjakhade@cadence.com>
phy: cadence: Sierra: Fix to get correct parent for mux clocks
Michael Ellerman <mpe@ellerman.id.au>
powerpc/64s: Use EMIT_WARN_ENTRY for SRR debug warnings
Michael Ellerman <mpe@ellerman.id.au>
powerpc/64s: Mask NIP before checking against SRR0
Jiasheng Jiang <jiasheng@iscas.ac.cn>
ASoC: mediatek: Check for error clk pointer
Ryuta NAKANISHI <nakanishi.ryuta@socionext.com>
phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
Alan Stern <stern@rowland.harvard.edu>
scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()
Pingfan Liu <kernelfans@gmail.com>
efi: apply memblock cap after memblock_add()
Zhen Lei <thunder.leizhen@huawei.com>
of: fdt: Aggregate the processing of "linux,usable-memory-range"
Trevor Wu <trevor.wu@mediatek.com>
ASoC: mediatek: mt8195: correct default value
Xiongfeng Wang <wangxiongfeng2@huawei.com>
iommu/iova: Fix race between FQ timeout and teardown
Cezary Rojewski <cezary.rojewski@intel.com>
ASoC: Intel: catpt: Test dmaengine_submit() result before moving on
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: Remove useless irq affinity notifier
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: X2apic mode: mask/unmask interrupts on suspend/resume
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: X2apic mode: setup the INTX registers on mask/unmask
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: X2apic mode: re-enable after resume
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: Restore GA log/tail pointer on host resume
Arnd Bergmann <arnd@arndb.de>
dmaengine: pxa/mmp: stop referencing config->slave_id
Lukas Bulwahn <lukas.bulwahn@gmail.com>
mips: fix Kconfig reference to PHYS_ADDR_T_64BIT
Lukas Bulwahn <lukas.bulwahn@gmail.com>
mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support
Dillon Min <dillon.minfei@gmail.com>
clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell
Frank Rowand <frank.rowand@sony.com>
of: unittest: 64 bit dma address test requires arch support
Jim Quinlan <jim2101024@gmail.com>
of: unittest: fix warning on PowerPC frame size warning
Jiasheng Jiang <jiasheng@iscas.ac.cn>
ASoC: rt5663: Handle device_property_read_u32_array error codes
Avihai Horon <avihaih@nvidia.com>
RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
Avihai Horon <avihaih@nvidia.com>
RDMA/core: Let ib_find_gid() continue search even after empty entry
Rob Clark <robdclark@chromium.org>
iommu/arm-smmu-qcom: Fix TTBR0 read
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/powermac: Add additional missing lockdep_register_key()
Thomas Gleixner <tglx@linutronix.de>
PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
Kamal Heib <kamalheib1@gmail.com>
RDMA/qedr: Fix reporting max_{send/recv}_wr attrs
Bart Van Assche <bvanassche@acm.org>
scsi: ufs: Fix race conditions related to driver data
Bart Van Assche <bvanassche@acm.org>
scsi: core: Fix scsi_device_max_queue_depth()
Hector Martin <marcan@marcan.st>
iommu/io-pgtable-arm: Fix table descriptor paddr formatting
Lu Baolu <baolu.lu@linux.intel.com>
iommu: Extend mutex lock scope in iommu_probe_device()
Jiasheng Jiang <jiasheng@iscas.ac.cn>
uio: uio_dmem_genirq: Catch the Exception
Stafford Horne <shorne@gmail.com>
openrisc: Add clone3 ABI wrapper
Todd Kjos <tkjos@google.com>
binder: avoid potential data leakage when copying txn
Todd Kjos <tkjos@google.com>
binder: fix handling of error during copy
Kees Cook <keescook@chromium.org>
char/mwave: Adjust io port register size
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
misc: at25: Make driver OF independent again
Takashi Iwai <tiwai@suse.de>
ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID
Bixuan Cui <cuibixuan@linux.alibaba.com>
ALSA: oss: fix compile error when OSS_DEBUG is enabled
Waiman Long <longman@redhat.com>
clocksource: Avoid accidental unstable marking of clocksources
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/32s: Fix shift-out-of-bounds in KASAN init
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/modules: Don't WARN on first module allocation attempt
Athira Rajeev <atrajeev@linux.vnet.ibm.com>
powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
dt-bindings: thermal: Fix definition of cooling-maps contribution property
Thomas Gleixner <tglx@linutronix.de>
ALSA: hda: Make proper use of timecounter
Jack Wang <jinpu.wang@ionos.com>
RDMA/rtrs-clt: Fix the initial value of min_latency
Lukas Bulwahn <lukas.bulwahn@gmail.com>
ASoC: codecs: wcd938x: add SND_SOC_WCD938_SDW to codec list instead
Lukas Bulwahn <lukas.bulwahn@gmail.com>
ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA
Peiwei Hu <jlu.hpw@foxmail.com>
powerpc/prom_init: Fix improper check of prom_getprop()
Adam Ford <aford173@gmail.com>
clk: imx8mn: Fix imx8mn_clko1_sels
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
clk: renesas: rzg2l: propagate return value of_genpd_add_provider_simple()
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
clk: renesas: rzg2l: Check return value of pm_genpd_init()
Igor Pylypiv <ipylypiv@google.com>
scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd()
Kamal Heib <kamalheib1@gmail.com>
RDMA/hns: Validate the pkey index
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit"
Takashi Iwai <tiwai@suse.de>
ALSA: hda: Fix potential deadlock at codec unbinding
Takashi Iwai <tiwai@suse.de>
ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
Takashi Iwai <tiwai@suse.de>
ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
Takashi Iwai <tiwai@suse.de>
ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: Intel: sof_sdw: fix jack detection on HP Spectre x360 convertible
Jan Kara <jack@suse.cz>
ext4: avoid trim error on fs with small groups
Pavel Skripkin <paskripkin@gmail.com>
net: mcs7830: handle usb read errors properly
Edwin Peer <edwin.peer@broadcom.com>
bnxt_en: use firmware provided max timeout for messages
Edwin Peer <edwin.peer@broadcom.com>
bnxt_en: move coredump functions into dedicated file
Edwin Peer <edwin.peer@broadcom.com>
bnxt_en: Refactor coredump functions
Nathan Chancellor <nathan@kernel.org>
iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing()
Paul Blakey <paulb@nvidia.com>
net: openvswitch: Fix ct_state nat flags for conns arriving from tc
Paul Blakey <paulb@nvidia.com>
net: openvswitch: Fix matching zone id for invalid conns arriving from tc
Paul Blakey <paulb@nvidia.com>
net/sched: flow_dissector: Fix matching on zone id for invalid conns
Dominik Brodowski <linux@dominikbrodowski.net>
pcmcia: fix setting of kthread task states
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
can: rcar_canfd: rcar_canfd_channel_probe(): make sure we free CAN network device
Jiasheng Jiang <jiasheng@iscas.ac.cn>
can: xilinx_can: xcan_probe(): check for error irq
Marc Kleine-Budde <mkl@pengutronix.de>
can: softing: softing_startstop(): fix set but not used variable warning
Christophe Jaillet <christophe.jaillet@wanadoo.fr>
tpm_tis: Fix an error handling path in 'tpm_tis_core_init()'
Chen Jun <chenjun102@huawei.com>
tpm: add request_locality before write TPM_INT_ENABLE
Marc Kleine-Budde <mkl@pengutronix.de>
can: mcp251xfd: add missing newline to printed strings
Vladimir Oltean <vladimir.oltean@nxp.com>
net: mscc: ocelot: fix incorrect balancing with down LAG ports
Fabio Estevam <festevam@denx.de>
regmap: Call regmap_debugfs_exit() prior to _init()
Dan Carpenter <dan.carpenter@oracle.com>
netrom: fix api breakage in nr_setsockopt()
Dan Carpenter <dan.carpenter@oracle.com>
ax25: uninitialized variable in ax25_setsockopt()
Subbaraya Sundeep <sbhatta@marvell.com>
octeontx2-af: Increment ptp refcount before use
Miaoqian Lin <linmq006@gmail.com>
spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
Geliang Tang <geliang.tang@suse.com>
mptcp: fix a DSS option writing error
Matthieu Baerts <matthieu.baerts@tessares.net>
mptcp: fix opt size when sending DSS + MP_FAIL
Paolo Abeni <pabeni@redhat.com>
mptcp: fix per socket endpoint accounting
Dan Carpenter <dan.carpenter@oracle.com>
Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
Zizhuang Deng <sunsetdzz@gmail.com>
lib/mpi: Add the return value check of kcalloc()
Moshe Shemesh <moshe@nvidia.com>
net/mlx5: Set command entry semaphore up once got index free
Maor Dickman <maord@nvidia.com>
net/mlx5e: Sync VXLAN udp ports during uplink representor profile change
Shay Drory <shayd@nvidia.com>
net/mlx5: Fix access to sf_dev_table on allocation failure
Paul Blakey <paulb@nvidia.com>
net/mlx5e: Fix matching on modified inner ip_ecn bits
Aya Levin <ayal@nvidia.com>
Revert "net/mlx5e: Block offload of outer header csum for GRE tunnel"
Aya Levin <ayal@nvidia.com>
Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
Maor Dickman <maord@nvidia.com>
net/mlx5e: Don't block routes with nexthop objects in SW
Maor Dickman <maord@nvidia.com>
net/mlx5e: Fix wrong usage of fib_info_nh when routes with nexthop objects are used
Aya Levin <ayal@nvidia.com>
net/mlx5e: Fix page DMA map/unmap attributes
Huang Rui <ray.huang@amd.com>
x86, sched: Fix undefined reference to init_freq_invariance_cppc() build error
Valentin Caron <valentin.caron@foss.st.com>
serial: stm32: move tx dma terminate DMA to shutdown
Alyssa Ross <hi@alyssa.is>
serial: liteuart: fix MODULE_ALIAS
Miaoqian Lin <linmq006@gmail.com>
drivers/firmware: Add missing platform_device_put() in sysfb_create_simplefb
Michal Suchanek <msuchanek@suse.de>
debugfs: lockdown: Allow reading debugfs files that are not world readable
José Expósito <jose.exposito89@gmail.com>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad
José Expósito <jose.exposito89@gmail.com>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init
José Expósito <jose.exposito89@gmail.com>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc
José Expósito <jose.exposito89@gmail.com>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
Pavel Hofman <pavel.hofman@ivitera.com>
usb: gadget: u_audio: Subdevice 0 for capture ctls
John Keeping <john@metanate.com>
usb: dwc2: gadget: initialize max_speed from params
Dinh Nguyen <dinguyen@kernel.org>
usb: dwc2: do not gate off the hardware if it does not support clock gating
Miaoqian Lin <linmq006@gmail.com>
usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe
Wen Gu <guwen@linux.alibaba.com>
net/smc: Reset conn->lgr when link group registration fails
Miaoqian Lin <linmq006@gmail.com>
Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe
Jiasheng Jiang <jiasheng@iscas.ac.cn>
Bluetooth: hci_bcm: Check for error irq
Jiasheng Jiang <jiasheng@iscas.ac.cn>
fsl/fman: Check for null pointer after calling devm_ioremap
Jiasheng Jiang <jiasheng@iscas.ac.cn>
staging: greybus: audio: Check null pointer
Dan Carpenter <dan.carpenter@oracle.com>
rocker: fix a sleeping in atomic bug
Eric Dumazet <edumazet@google.com>
ppp: ensure minimum packet size in ppp_write()
Miroslav Lichvar <mlichvar@redhat.com>
net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
Kuniyuki Iwashima <kuniyu@amazon.co.jp>
bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
Kris Van Hees <kris.van.hees@oracle.com>
bpf: Fix verifier support for validation of async callbacks
Daniel Borkmann <daniel@iogearbox.net>
bpf: Don't promote bogus looking registers after null check.
John Fastabend <john.fastabend@gmail.com>
bpf, sockmap: Fix double bpf_prog_put on error case in map_link
John Fastabend <john.fastabend@gmail.com>
bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser()
Xin Xiong <xiongx18@fudan.edu.cn>
netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
Vladimir Oltean <vladimir.oltean@nxp.com>
net: dsa: fix incorrect function pointer check for MRP ring roles
Daniel Golle <daniel@makrotopia.org>
net: ethernet: mtk_eth_soc: fix return values and refactor MDIO ops
Raed Salem <raeds@nvidia.com>
net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path
Jiasheng Jiang <jiasheng@iscas.ac.cn>
power: reset: mt6397: Check for null res pointer
Zhou Qingyang <zhou1615@umn.edu>
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
Zhou Qingyang <zhou1615@umn.edu>
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
Hans de Goede <hdegoede@redhat.com>
ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
serial: 8250_bcm7271: Propagate error codes from brcmuart_probe()
Pavel Begunkov <asml.silence@gmail.com>
io_uring: remove double poll on poll update
Zhang Zixun <zhang133010@icloud.com>
x86/mce/inject: Avoid out-of-bounds write when setting flags
Arseny Demidov <arsdemal@gmail.com>
hwmon: (mr75203) fix wrong power-up delay value
Marijn Suijten <marijn.suijten@somainline.org>
regulator: qcom-labibb: OCP interrupts are not a failure while disabled
Dan Carpenter <dan.carpenter@oracle.com>
crypto: octeontx2 - prevent underflow in get_cores_bmap()
Nathan Chancellor <nathan@kernel.org>
x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS
Panicker Harish <quic_pharish@quicinc.com>
Bluetooth: hci_qca: Stop IBS timer during BT OFF
Clément Léger <clement.leger@bootlin.com>
software node: fix wrong node passed to find nargs_prop
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Respect enabled-strings in set_brightness
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Override default length with qcom,enabled-strings
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Fix off-by-one maximum with default num_strings
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Pass number of elements to read to read_u32_array
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Validate enabled string indices in DT
Paul Chaignon <paul@isovalent.com>
bpftool: Enable line buffering for stdout
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix using wrong mode
Johannes Berg <johannes.berg@intel.com>
um: virtio_uml: Fix time-travel external time propagation
Johannes Berg <johannes.berg@intel.com>
lib/logic_iomem: Fix operation on 32-bit
Johannes Berg <johannes.berg@intel.com>
lib/logic_iomem: Fix 32-bit build
Johannes Berg <johannes.berg@intel.com>
um: virt-pci: Fix 32-bit compile
Johannes Berg <johannes.berg@intel.com>
um: rename set_signals() to um_set_signals()
Johannes Berg <johannes.berg@intel.com>
um: fix ndelay/udelay defines
Bernard Zhao <bernard@vivo.com>
selinux: fix potential memleak in selinux_add_opt()
Christoph Hellwig <hch@lst.de>
block: fix error unwinding in device_add_disk
Sergey Shtylyov <s.shtylyov@omp.ru>
mmc: meson-mx-sdio: add IRQ check
Sergey Shtylyov <s.shtylyov@omp.ru>
mmc: meson-mx-sdhc: add IRQ check
Avraham Stern <avraham.stern@intel.com>
iwlwifi: mvm: set protected flag only for NDP ranging
Avraham Stern <avraham.stern@intel.com>
iwlwifi: mvm: perform 6GHz passive scan after suspend
Nathan Errera <nathan.errera@intel.com>
iwlwifi: mvm: test roc running status bits before removing the sta
Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: fix 32-bit build in FTM
Kai-Heng Feng <kai.heng.feng@canonical.com>
rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
Ping-Ke Shih <pkshih@realtek.com>
rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC
Dan Carpenter <dan.carpenter@oracle.com>
wilc1000: fix double free error in probe()
Sean Wang <sean.wang@mediatek.com>
mt76: mt7921: drop offload_flags overwritten
Marek Behún <kabel@kernel.org>
ARM: dts: armada-38x: Add generic compatible to UART nodes
Robert Marko <robert.marko@sartura.hr>
arm64: dts: marvell: cn9130: enable CP0 GPIO controllers
Robert Marko <robert.marko@sartura.hr>
arm64: dts: marvell: cn9130: add GPIO and SPI aliases
Wei Yongjun <weiyongjun1@huawei.com>
usb: ftdi-elan: fix memory leak on device disconnect
Andre Przywara <andre.przywara@arm.com>
ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
Antony Antony <antony.antony@secunet.com>
xfrm: state and policy should fail if XFRMA_IF_ID 0
Antony Antony <antony.antony@secunet.com>
xfrm: interface with if_id 0 should return error
Jernej Skrabec <jernej.skrabec@gmail.com>
media: hantro: Fix probe func error path
Robin Murphy <robin.murphy@arm.com>
drm/tegra: vic: Fix DMA API misuse
Thierry Reding <treding@nvidia.com>
drm/tegra: gr2d: Explicitly control module reset
Arnd Bergmann <arnd@arndb.de>
gpu: host1x: select CONFIG_DMA_SHARED_BUFFER
Stephen Boyd <swboyd@chromium.org>
drm/bridge: ti-sn65dsi86: Set max register for regmap
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
drm/msm/dpu: fix safe status debugfs file
Baruch Siach <baruch@tkos.co.il>
arm64: dts: qcom: ipq6018: Fix gpio-ranges property
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
arm64: dts: qcom: c630: Fix soundcard setup
Kurt Kanzenbach <kurt@linutronix.de>
net: dsa: hellcreek: Add missing PTP via UDP rules
Kurt Kanzenbach <kurt@linutronix.de>
net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports
Kurt Kanzenbach <kurt@linutronix.de>
net: dsa: hellcreek: Add STP forwarding rule
Kurt Kanzenbach <kurt@linutronix.de>
net: dsa: hellcreek: Fix insertion of static FDB entries
Zhou Qingyang <zhou1615@umn.edu>
ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()
Jiasheng Jiang <jiasheng@iscas.ac.cn>
media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
Wang Hai <wanghai38@huawei.com>
media: msi001: fix possible null-ptr-deref in msi001_probe()
Anton Vasilyev <vasilyev@ispras.ru>
media: dw2102: Fix use after free
Robin Murphy <robin.murphy@arm.com>
perf/arm-cmn: Fix CPU hotplug unregistration
Christian Lamparter <chunkeey@gmail.com>
ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors
Hector Martin <marcan@marcan.st>
spi: Fix incorrect cs_setup delay handling
Rameshkumar Sundaram <quic_ramess@quicinc.com>
ath11k: Fix deleting uninitialized kernel timer during fragment cache flush
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/qm - fix incorrect return value of hisi_qm_resume()
Herbert Xu <herbert@gondor.apana.org.au>
crypto: stm32 - Revert broken pm_runtime_resume_and_get changes
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix bugs and crash in tests
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix lrw chaining mode
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix double pm exit
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - check early input data
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix xts and race condition in crypto_engine requests
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix CTR counter carry
Jakub Kicinski <kuba@kernel.org>
selftests: harness: avoid false negatives if test has no ASSERTs
Anders Roxell <anders.roxell@linaro.org>
selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST
Kees Cook <keescook@chromium.org>
x86/uaccess: Move variable into switch case statement
Eric Dumazet <edumazet@google.com>
xfrm: fix a small bug in xfrm_sa_len()
Brian Norris <briannorris@chromium.org>
mwifiex: Fix possible ABBA deadlock
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
drm/msm/dsi: fix initialization in the bonded DSI case
Loic Poulain <loic.poulain@linaro.org>
wcn36xx: Fix max channels retrieval
Frederic Weisbecker <frederic@kernel.org>
rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
Jackie Liu <liuyun01@kylinos.cn>
drm/msm/dp: displayPort driver need algorithm rational
Rob Clark <robdclark@chromium.org>
drm/msm/gpu: Don't allow zero fence_id
Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
drm/amd/display: Fix out of bounds access on DNC31 stream encoder regs
Wayne Lin <Wayne.Lin@amd.com>
drm/amd/display: Fix bug in debugfs crc_win_update entry
Mark Chen <mark-yw.chen@mediatek.com>
Bluetooth: btusb: Handle download_firmware failure cases
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: MGMT: Use hci_dev_test_and_{set,clear}_flag
Joseph Hwang <josephsih@chromium.org>
Bluetooth: refactor set_exp_feature with a feature table
Fabio Estevam <festevam@denx.de>
ath10k: Fix the MTU size on QCA9377 SDIO
Li Hua <hucool.lihua@huawei.com>
sched/rt: Try to restart rt period timer when rt runtime exceeded
Lv Yunlong <lyl2019@mail.ustc.edu.cn>
wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma
Robert Schlabbach <robert_s@gmx.net>
media: si2157: Fix "warm" tuner state detection
Zhou Qingyang <zhou1615@umn.edu>
media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
Zhou Qingyang <zhou1615@umn.edu>
media: dib8000: Fix a memleak in dib8000_init()
Alexander Lobakin <alexandr.lobakin@intel.com>
samples: bpf: Fix 'unknown warning group' build warning on Clang
Alexander Lobakin <alexandr.lobakin@intel.com>
samples: bpf: Fix xdp_sample_user.o linking with Clang
Andrii Nakryiko <andrii@kernel.org>
samples/bpf: Clean up samples/bpf build failes
Quentin Monnet <quentin@isovalent.com>
samples/bpf: Install libbpf headers when building
Reiji Watanabe <reijiw@google.com>
arm64: mte: DC {GVA,GZVA} shouldn't be used when DCZID_EL0.DZP == 1
Reiji Watanabe <reijiw@google.com>
arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1
Kajol Jain <kjain@linux.ibm.com>
bpf: Remove config check to enable bpf support for branch records
Hou Tao <houtao1@huawei.com>
bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)
Alexei Starovoitov <ast@kernel.org>
bpf: Adjust BTF log size limit.
Vincent Donnefort <vincent.donnefort@arm.com>
sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity
Vincent Donnefort <vincent.donnefort@arm.com>
sched/fair: Fix detection of per-CPU kthreads waking a task
Maxim Mikityanskiy <maximmi@nvidia.com>
bpf: Fix the test_task_vma selftest to support output shorter than 1 kB
Sean Wang <sean.wang@mediatek.com>
Bluetooth: btmtksdio: fix resume failure
Yang Yingliang <yangyingliang@huawei.com>
staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()
Yang Yingliang <yangyingliang@huawei.com>
staging: rtl8192e: return error code from rtllib_softmac_init()
Tasos Sahanidis <tasos@tasossah.com>
floppy: Fix hang in watchdog when disk is ejected
Michael Walle <michael@walle.cc>
mtd: core: provide unique name for nvmem device
Lino Sanfilippo <LinoSanfilippo@gmx.de>
serial: amba-pl011: do not request memory region twice
Lizhi Hou <lizhi.hou@xilinx.com>
tty: serial: uartlite: allow 64 bit address
Nishanth Menon <nm@ti.com>
arm64: dts: ti: k3-j7200: Correct the d-cache-sets info
Nishanth Menon <nm@ti.com>
arm64: dts: ti: k3-j721e: Fix the L2 cache sets
Nishanth Menon <nm@ti.com>
arm64: dts: ti: k3-j7200: Fix the L2 cache sets
Nishanth Menon <nm@ti.com>
arm64: dts: ti: k3-am642: Fix the L2 cache sets
Gaurav Jain <gaurav.jain@nxp.com>
crypto: caam - save caam memory to support crypto engine retry mechanism.
Alexei Starovoitov <ast@kernel.org>
libbpf: Clean gen_loader's attach kind.
Zhou Qingyang <zhou1615@umn.edu>
drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
Zhou Qingyang <zhou1615@umn.edu>
drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
Paul Gerber <Paul.Gerber@tq-group.com>
thermal/drivers/imx8mm: Enable ADC when enabling monitor
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: EC: Rework flushing of EC work while suspended to idle
William Kucharski <william.kucharski@oracle.com>
cgroup: Trace event cgroup id fields should be u64
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Fail to initialize on broken configs
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Remove the deprecated lower mem limit
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
arm64: dts: qcom: msm8916: fix MMC controller aliases
Mark Rutland <mark.rutland@arm.com>
powerpc: Avoid discarding flags in system_call_exception()
Florian Westphal <fw@strlen.de>
netfilter: bridge: add support for pppoe filtering
Jesper Dangaard Brouer <brouer@redhat.com>
igc: AF_XDP zero-copy metadata adjust breaks SKBs on XDP_PASS
Oleksij Rempel <linux@rempel-privat.de>
thermal/drivers/imx: Implement runtime PM support
Bhupesh Sharma <bhupesh.sharma@linaro.org>
net: stmmac: Add platform level debug register dump feature
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()'
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: venus: core: Fix a potential NULL pointer dereference in an error handling path
Mansur Alisha Shaik <mansur@codeaurora.org>
media: venus: correct low power frequency calculation for encoder
Philipp Zabel <p.zabel@pengutronix.de>
media: coda: fix CODA960 JPEG encoder buffer overflow
Chen-Yu Tsai <wenst@chromium.org>
media: hantro: Hook up RK3399 JPEG encoder output
Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
Yang Yingliang <yangyingliang@huawei.com>
media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
Fabio Estevam <festevam@denx.de>
media: imx-pxp: Initialize the spinlock prior to using it
Suresh Udipi <sudipi@jp.adit-jv.com>
media: rcar-csi2: Correct the selection of hsfreqrange
Hans de Goede <hdegoede@redhat.com>
media: i2c: ov8865: Fix lockdep error
Daniel Scally <djrscally@gmail.com>
media: i2c: Re-order runtime pm initialisation
Eugen Hristev <eugen.hristev@microchip.com>
media: i2c: imx274: fix s_frame_interval runtime resume not requested
Alan Maguire <alan.maguire@oracle.com>
libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data
Jan Kara <jack@suse.cz>
bfq: Do not let waker requests skip proper accounting
Claudiu Beznea <claudiu.beznea@microchip.com>
mfd: atmel-flexcom: Use .resume_noirq
Claudiu Beznea <claudiu.beznea@microchip.com>
mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP
Tudor Ambarus <tudor.ambarus@microchip.com>
tty: serial: atmel: Call dma_async_issue_pending()
Tudor Ambarus <tudor.ambarus@microchip.com>
tty: serial: atmel: Check return code of dmaengine_submit()
Peng Fan <peng.fan@nxp.com>
arm64: dts: ti: k3-j721e: correct cache-sets info
Anilkumar Kolli <akolli@codeaurora.org>
ath11k: Use host CE parameters for CE interrupts configuration
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - fix undetected PFVF timeout in ACK loop
Marco Chiappero <marco.chiappero@intel.com>
crypto: qat - make pfvf send message direction agnostic
Marco Chiappero <marco.chiappero@intel.com>
crypto: qat - remove unnecessary collision prevention step in PFVF
Andrii Nakryiko <andrii@kernel.org>
libbpf: Fix using invalidated memory in bpf_linker
Andrii Nakryiko <andrii@kernel.org>
libbpf: Fix glob_syms memory leak in bpf_linker
Andrii Nakryiko <andrii@kernel.org>
libbpf: Fix potential misaligned memory access in btf_ext__new()
Dillon Min <dillon.minfei@gmail.com>
ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco
Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
cpufreq: qcom-hw: Fix probable nested interrupt handling
Lukasz Luba <lukasz.luba@arm.com>
cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure
George G. Davis <davis.george@siemens.com>
mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove
Prasad Malisetty <pmaliset@codeaurora.org>
arm64: dts: qcom: sc7280: Fix incorrect clock name
Chengfeng Ye <cyeaa@connect.ust.hk>
crypto: qce - fix uaf on qce_skcipher_register_one
Chengfeng Ye <cyeaa@connect.ust.hk>
crypto: qce - fix uaf on qce_ahash_register_one
Chengfeng Ye <cyeaa@connect.ust.hk>
crypto: qce - fix uaf on qce_aead_register_one
Tudor Ambarus <tudor.ambarus@microchip.com>
crypto: atmel-aes - Reestablish the correct tfm context at dequeue
Wang Hai <wanghai38@huawei.com>
media: dmxdev: fix UAF when dvb_register_device() fails
Biju Das <biju.das.jz@bp.renesas.com>
arm64: dts: renesas: cat875: Add rx/tx delays
Dan Carpenter <dan.carpenter@oracle.com>
drm/vboxvideo: fix a NULL vs IS_ERR() check
Lyude Paul <lyude@redhat.com>
drm/dp: Don't read back backlight mode in drm_edp_backlight_enable()
Alexander Aring <aahringo@redhat.com>
fs: dlm: fix build with CONFIG_IPV6 disabled
Jens Wiklander <jens.wiklander@linaro.org>
tee: fix put order in teedev_close_context()
oujiefeng <oujiefeng@huawei.com>
spi: hisi-kunpeng: Fix the debugfs directory name incorrect
Karthikeyan Kathirvel <kathirve@codeaurora.org>
ath11k: reset RSN/WPA present state for open BSS
Karthikeyan Kathirvel <kathirve@codeaurora.org>
ath11k: clear the keys properly via DISABLE_KEY
Sven Eckelmann <sven@narfation.org>
ath11k: Fix ETSI regd with weather radar overlap
Pavel Skripkin <paskripkin@gmail.com>
Bluetooth: stop proccessing malicious adv data
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
Alexander Aring <aahringo@redhat.com>
fs: dlm: don't call kernel_getpeername() in error_report()
Christian Hewitt <christianshewitt@gmail.com>
arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
Christian Hewitt <christianshewitt@gmail.com>
arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
Alexander Stein <alexander.stein@mailbox.org>
arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+
Alexander Stein <alexander.stein@mailbox.org>
arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name
Jammy Huang <jammy_huang@aspeedtech.com>
media: aspeed: Update signal status immediately to ensure sane hw state
Dongliang Mu <mudongliangabcd@gmail.com>
media: em28xx: fix memory leak in em28xx_init_dev
Jammy Huang <jammy_huang@aspeedtech.com>
media: aspeed: fix mode-detect always time out at 2nd run
Dan Carpenter <dan.carpenter@oracle.com>
media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: fix enum formats logic
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: add NULL check for asd obtained from atomisp_video_pipe
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix ifdefs in sh_css.c
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid()
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: do not use err var when checking port validity for ISP2400
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix inverted logic in buffers_needed()
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities()
Dillon Min <dillon.minfei@gmail.com>
media: videobuf2: Fix the size printk format
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()
Quentin Monnet <quentin@isovalent.com>
bpftool: Fix memory leak in prog_dump()
Rameshkumar Sundaram <ramess@codeaurora.org>
ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
Benjamin Li <benl@squareup.com>
wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
Benjamin Li <benl@squareup.com>
wcn36xx: populate band before determining rate on RX
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
wcn36xx: Put DXE block into reset before freeing memory
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
wcn36xx: Release DMA channel descriptor allocations
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
wcn36xx: Fix DMA channel enable/disable cycle
Andrii Nakryiko <andrii@kernel.org>
libbpf: Free up resources used by inner map definition
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Enable the scrambler on reconnection
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
Benjamin Li <benl@squareup.com>
wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan
Maxime Ripard <maxime@cerno.tech>
drm/vc4: crtc: Make sure the HDMI controller is powered when disabling
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Rework the pre_crtc_configure error handling
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Make sure the controller is powered up during bind
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Make sure the controller is powered in detect
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Move the HSM clock enable to runtime_pm
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Set a default HSM rate
Maxime Ripard <maxime@cerno.tech>
clk: bcm-2835: Remove rounding up the dividers
Maxime Ripard <maxime@cerno.tech>
clk: bcm-2835: Pick the closest clock rate
Wang Hai <wanghai38@huawei.com>
Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
Soenke Huster <soenke.huster@eknoes.de>
Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle()
Brian Norris <briannorris@chromium.org>
drm/rockchip: dsi: Reconfigure hardware on resume()
Brian Norris <briannorris@chromium.org>
drm/rockchip: dsi: Disable PLL clock on bind error
Brian Norris <briannorris@chromium.org>
drm/rockchip: dsi: Hold pm-runtime across bind/unbind
Brian Norris <briannorris@chromium.org>
drm/rockchip: dsi: Fix unbalanced clock on probe error
Brian Norris <briannorris@chromium.org>
drm/panel: innolux-p079zca: Delete panel on attach() failure
Brian Norris <briannorris@chromium.org>
drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
Wang Hai <wanghai38@huawei.com>
drm: fix null-ptr-deref in drm_dev_init_release()
Dan Carpenter <dan.carpenter@oracle.com>
drm/bridge: display-connector: fix an uninitialized pointer in probe()
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix not initializing sk_peer_pid
xinhui pan <xinhui.pan@amd.com>
drm/ttm: Put BO in its memory manager's lru list
Gang Li <ligang.bdlg@bytedance.com>
shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
Wen Gong <quic_wgong@quicinc.com>
ath11k: add string type to search board data in board-2.bin for WCN6855
Baoquan He <bhe@redhat.com>
mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
Baoquan He <bhe@redhat.com>
dma/pool: create dma atomic pool only if dma zone has managed pages
Baoquan He <bhe@redhat.com>
mm_zone: add function to check if managed dma zone exists
Yifeng Li <tomli@tomli.me>
PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
Thomas Hellström <thomas.hellstrom@linux.intel.com>
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
Peng Hao <flyingpenghao@gmail.com>
virtio/virtio_mem: handle a possible NULL as a memcpy parameter
Dmitry Osipenko <digetx@gmail.com>
drm/tegra: Add back arm_iommu_detach_device()
Dmitry Osipenko <digetx@gmail.com>
gpu: host1x: Add back arm_iommu_detach_device()
Yunfei Wang <yf.wang@mediatek.com>
iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
Hari Prasath <Hari.PrasathGE@microchip.com>
ARM: dts: at91: update alternate function of signal PD20
D Scott Phillips <scott@os.amperecomputing.com>
arm64: errata: Fix exec handling in erratum 1418040 workaround
Dan Williams <dan.j.williams@intel.com>
cxl/pmem: Fix reference counting for delayed work
Manivannan Sadhasivam <mani@kernel.org>
bus: mhi: core: Fix race while handling SYS_ERR at power up
Bhaumik Bhatt <quic_bbhatt@quicinc.com>
bus: mhi: core: Fix reading wake_capable channel configuration
Loic Poulain <loic.poulain@linaro.org>
bus: mhi: pci_generic: Graceful shutdown on freeze
Christophe Leroy <christophe.leroy@csgroup.eu>
lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
Jonathan Cameron <Jonathan.Cameron@huawei.com>
iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046
Jonathan Cameron <Jonathan.Cameron@huawei.com>
iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
Alexander Usyskin <alexander.usyskin@intel.com>
mei: hbm: fix client dma reply status
Johan Hovold <johan@kernel.org>
can: softing_cs: softingcs_probe(): fix memleak on registration failure
Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: cec-pin: fix interrupt en/disable handling
Johan Hovold <johan@kernel.org>
media: stk1160: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: pvrusb2: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: redrat3: fix control-message timeouts
Michael Kuron <michael.kuron@gmail.com>
media: dib0700: fix undefined behavior in tuner shutdown
Johan Hovold <johan@kernel.org>
media: s2255: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: cpia2: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: em28xx: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: mceusb: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: flexcop-usb: fix control-message timeouts
Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
Sakari Ailus <sakari.ailus@linux.intel.com>
media: ov8865: Disable only enabled regulators on error path
Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: cec: fix a deadlock situation
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: add reserved room in ipc request/response
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: limits exceeding the maximum allowable outstanding requests
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: move credit charge deduction under processing request
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: add support for smb2 max credit parameter
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix guest connection failure with nautilus
Dan Carpenter <dan.carpenter@oracle.com>
ksmbd: uninitialized variable in create_socket()
Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
net: phy: marvell: add Marvell specific PHY loopback
Mateusz Jończyk <mat.jonczyk@o2.pl>
rtc: cmos: take rtc_lock while reading from CMOS
Willy Tarreau <w@1wt.eu>
tools/nolibc: fix incorrect truncation of exit code
Willy Tarreau <w@1wt.eu>
tools/nolibc: i386: fix initial stack alignment
Jakub Kicinski <kuba@kernel.org>
crypto: x86/aesni - don't require alignment of data
Ammar Faizi <ammar.faizi@students.amikom.ac.id>
tools/nolibc: x86-64: Fix startup code bug
Lucas De Marchi <lucas.demarchi@intel.com>
x86/gpu: Reserve stolen memory for first integrated Intel GPU
Jisheng Zhang <jszhang@kernel.org>
riscv: mm: fix wrong phys_ram_base value for RV64
Nick Kossifidis <mick@ics.forth.gr>
riscv: use hart id instead of cpu id on machine_kexec
Nick Kossifidis <mick@ics.forth.gr>
riscv: Don't use va_pa_offset on kdump
Nick Kossifidis <mick@ics.forth.gr>
riscv: try to allocate crashkern region from 32bit addressible memory
Sean Christopherson <seanjc@google.com>
RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n
Alexandre Ghiti <alexandre.ghiti@canonical.com>
riscv: Get rid of MAXPHYSMEM configs
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: ingenic: JZ4740 needs 'oob_first' read page function
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: Export nand_read_page_hwecc_oob_first()
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: davinci: Rewrite function description
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: davinci: Avoid duplicated page read
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: davinci: Don't calculate ECC when reading page
Andreas Oetken <ennoerlangen@gmail.com>
mtd: Fixed breaking list in __mtd_del_partition.
Stefan Riedmueller <s.riedmueller@phytec.de>
mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
Christian Eggers <ceggers@arri.de>
mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
Jaegeuk Kim <jaegeuk@kernel.org>
f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file
Chao Yu <chao@kernel.org>
f2fs: fix to do sanity check in is_alive()
Chao Yu <chao@kernel.org>
f2fs: fix to do sanity check on inode type during garbage collection
Takashi Iwai <tiwai@suse.de>
ALSA: core: Fix SSID quirk lookup for subvendor=0
Jason Gerecke <killertofu@gmail.com>
HID: wacom: Avoid using stale array indicies to read contact count
Jason Gerecke <killertofu@gmail.com>
HID: wacom: Ignore the confidence flag when a touch is removed
Jason Gerecke <killertofu@gmail.com>
HID: wacom: Reset expected and received contact counts at the same time
Jann Horn <jannh@google.com>
HID: uhid: Fix worker destroying device without any protection
Karl Kurbjun <kkurbjun@gmail.com>
HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100
Marcelo Tosatti <mtosatti@redhat.com>
KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
David Matlack <dmatlack@google.com>
KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU
-------------
Diffstat:
Documentation/admin-guide/cifs/usage.rst | 7 +-
Documentation/admin-guide/devices.txt | 8 +-
Documentation/admin-guide/hw-vuln/spectre.rst | 2 +-
.../bindings/display/amlogic,meson-dw-hdmi.yaml | 5 +
.../bindings/display/amlogic,meson-vpu.yaml | 6 +
.../devicetree/bindings/input/hid-over-i2c.txt | 2 +
.../devicetree/bindings/thermal/thermal-zones.yaml | 9 +-
.../devicetree/bindings/watchdog/samsung-wdt.yaml | 5 +-
Documentation/driver-api/dmaengine/dmatest.rst | 7 +-
Documentation/driver-api/firewire.rst | 4 +-
.../acpi/dsd/data-node-references.rst | 10 +-
Documentation/trace/coresight/coresight-config.rst | 16 +-
Makefile | 4 +-
arch/arm/Kconfig.debug | 14 +-
arch/arm/boot/compressed/efi-header.S | 22 +-
arch/arm/boot/compressed/head.S | 3 +-
arch/arm/boot/dts/armada-38x.dtsi | 4 +-
arch/arm/boot/dts/gemini-nas4220b.dts | 2 +-
arch/arm/boot/dts/omap3-n900.dts | 50 +-
arch/arm/boot/dts/qcom-sdx55.dtsi | 6 +-
arch/arm/boot/dts/sama7g5-pinfunc.h | 2 +-
arch/arm/boot/dts/stm32f429-disco.dts | 2 +-
arch/arm/configs/cm_x300_defconfig | 1 -
arch/arm/configs/ezx_defconfig | 1 -
arch/arm/configs/imote2_defconfig | 1 -
arch/arm/configs/nhk8815_defconfig | 1 -
arch/arm/configs/pxa_defconfig | 1 -
arch/arm/configs/spear13xx_defconfig | 1 -
arch/arm/configs/spear3xx_defconfig | 1 -
arch/arm/configs/spear6xx_defconfig | 1 -
arch/arm/include/debug/imx-uart.h | 18 +-
arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c | 5 +-
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +-
.../boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 2 +-
arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 3 +
arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts | 14 +-
arch/arm64/boot/dts/marvell/cn9130.dtsi | 15 +
arch/arm64/boot/dts/nvidia/tegra186.dtsi | 2 +-
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 5 +-
arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +-
arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 -
arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
.../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 27 +
arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
arch/arm64/boot/dts/renesas/cat875.dtsi | 1 +
arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77951.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77960.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77961.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77965.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77980.dtsi | 4 +-
arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 10 +-
arch/arm64/boot/dts/ti/k3-am642.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-j7200.dtsi | 6 +-
arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-j721e.dtsi | 6 +-
arch/arm64/include/asm/extable.h | 9 -
arch/arm64/include/asm/memory.h | 5 +-
arch/arm64/include/asm/mte-kasan.h | 8 +-
arch/arm64/kernel/process.c | 39 +-
arch/arm64/kernel/traps.c | 2 +-
arch/arm64/lib/clear_page.S | 10 +
arch/arm64/lib/mte.S | 8 +-
arch/arm64/mm/ptdump.c | 2 -
arch/arm64/net/bpf_jit_comp.c | 7 +-
arch/mips/Kconfig | 6 +-
arch/mips/bcm63xx/clk.c | 6 +
arch/mips/boot/compressed/Makefile | 2 +-
arch/mips/boot/compressed/clz_ctz.c | 2 +
arch/mips/cavium-octeon/octeon-platform.c | 2 +
arch/mips/cavium-octeon/octeon-usb.c | 1 +
arch/mips/configs/fuloong2e_defconfig | 1 -
arch/mips/configs/malta_qemu_32r6_defconfig | 1 -
arch/mips/configs/maltaaprp_defconfig | 1 -
arch/mips/configs/maltasmvp_defconfig | 1 -
arch/mips/configs/maltasmvp_eva_defconfig | 1 -
arch/mips/configs/maltaup_defconfig | 1 -
.../asm/mach-loongson64/kernel-entry-init.h | 4 +-
arch/mips/include/asm/octeon/cvmx-bootinfo.h | 4 +-
arch/mips/lantiq/clk.c | 6 +
arch/openrisc/include/asm/syscalls.h | 2 +
arch/openrisc/kernel/entry.S | 5 +
arch/parisc/include/asm/special_insns.h | 44 +-
arch/parisc/kernel/traps.c | 2 +-
arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi | 2 +
arch/powerpc/configs/ppc6xx_defconfig | 1 -
arch/powerpc/configs/pseries_defconfig | 1 -
arch/powerpc/include/asm/hw_irq.h | 40 +
arch/powerpc/kernel/btext.c | 4 +-
arch/powerpc/kernel/fadump.c | 8 +
arch/powerpc/kernel/head_40x.S | 9 +-
arch/powerpc/kernel/interrupt.c | 2 +-
arch/powerpc/kernel/interrupt_64.S | 10 +-
arch/powerpc/kernel/module.c | 11 +-
arch/powerpc/kernel/prom_init.c | 2 +-
arch/powerpc/kernel/smp.c | 42 +
arch/powerpc/kernel/watchdog.c | 41 +-
arch/powerpc/kvm/book3s_hv.c | 8 +-
arch/powerpc/kvm/book3s_hv_nested.c | 2 +-
arch/powerpc/mm/book3s64/radix_pgtable.c | 4 +-
arch/powerpc/mm/kasan/book3s_32.c | 3 +-
arch/powerpc/mm/pgtable_64.c | 14 +-
arch/powerpc/perf/core-book3s.c | 58 +-
arch/powerpc/platforms/cell/iommu.c | 1 +
arch/powerpc/platforms/cell/pervasive.c | 1 +
arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 1 +
arch/powerpc/platforms/powermac/low_i2c.c | 3 +
arch/powerpc/platforms/powernv/opal-lpc.c | 1 +
arch/powerpc/sysdev/xive/spapr.c | 3 +
arch/riscv/Kconfig | 23 +-
arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi | 3 -
arch/riscv/configs/nommu_k210_defconfig | 2 -
arch/riscv/configs/nommu_k210_sdcard_defconfig | 2 -
arch/riscv/configs/nommu_virt_defconfig | 1 -
arch/riscv/include/asm/smp.h | 10 +-
arch/riscv/kernel/kexec_relocate.S | 20 +-
arch/riscv/kernel/machine_kexec.c | 3 +-
arch/riscv/kernel/setup.c | 10 +
arch/riscv/kernel/smp.c | 10 -
arch/riscv/mm/init.c | 19 +-
arch/s390/mm/pgalloc.c | 4 +-
arch/sh/configs/titan_defconfig | 1 -
arch/um/.gitignore | 1 +
arch/um/drivers/virt-pci.c | 8 +-
arch/um/drivers/virtio_uml.c | 4 +
arch/um/include/asm/delay.h | 4 +-
arch/um/include/asm/irqflags.h | 4 +-
arch/um/include/shared/longjmp.h | 2 +-
arch/um/include/shared/os.h | 4 +-
arch/um/include/shared/registers.h | 4 +-
arch/um/kernel/ksyms.c | 2 +-
arch/um/os-Linux/registers.c | 4 +-
arch/um/os-Linux/sigio.c | 6 +-
arch/um/os-Linux/signal.c | 8 +-
arch/um/os-Linux/start_up.c | 2 +-
arch/x86/boot/compressed/Makefile | 7 +-
arch/x86/configs/i386_defconfig | 1 +
arch/x86/configs/x86_64_defconfig | 1 +
arch/x86/crypto/aesni-intel_glue.c | 4 +-
arch/x86/include/asm/realmode.h | 1 +
arch/x86/include/asm/topology.h | 2 +-
arch/x86/include/asm/uaccess.h | 5 +-
arch/x86/kernel/cpu/mce/core.c | 42 +-
arch/x86/kernel/cpu/mce/inject.c | 2 +-
arch/x86/kernel/early-quirks.c | 10 +-
arch/x86/kernel/reboot.c | 12 +-
arch/x86/kvm/mmu/tdp_mmu.c | 6 +-
arch/x86/kvm/vmx/posted_intr.c | 16 +-
arch/x86/realmode/init.c | 26 +
arch/x86/um/syscalls_64.c | 3 +-
block/bfq-iosched.c | 44 +-
block/blk-flush.c | 4 +-
block/blk-pm.c | 22 +-
block/genhd.c | 15 +-
block/mq-deadline.c | 4 +-
crypto/jitterentropy.c | 3 +-
drivers/acpi/acpica/exfield.c | 7 +-
drivers/acpi/acpica/exoparg1.c | 3 +-
drivers/acpi/acpica/hwesleep.c | 4 +-
drivers/acpi/acpica/hwsleep.c | 4 +-
drivers/acpi/acpica/hwxfsleep.c | 2 -
drivers/acpi/acpica/utdelete.c | 1 +
drivers/acpi/battery.c | 22 +
drivers/acpi/bus.c | 4 +-
drivers/acpi/cppc_acpi.c | 2 +-
drivers/acpi/ec.c | 57 +-
drivers/acpi/internal.h | 2 +
drivers/acpi/scan.c | 13 +-
drivers/acpi/x86/utils.c | 116 ++-
drivers/android/binder.c | 98 ++-
drivers/base/core.c | 3 +-
drivers/base/power/runtime.c | 41 +-
drivers/base/property.c | 4 +-
drivers/base/regmap/regmap.c | 1 +
drivers/base/swnode.c | 2 +-
drivers/block/floppy.c | 6 +-
drivers/bluetooth/btintel.c | 26 +-
drivers/bluetooth/btmtksdio.c | 2 +
drivers/bluetooth/btusb.c | 5 +
drivers/bluetooth/hci_bcm.c | 7 +-
drivers/bluetooth/hci_qca.c | 9 +-
drivers/bluetooth/hci_vhci.c | 2 +
drivers/bluetooth/virtio_bt.c | 3 +
drivers/bus/mhi/core/init.c | 1 +
drivers/bus/mhi/core/pm.c | 35 +-
drivers/bus/mhi/pci_generic.c | 2 +-
drivers/char/mwave/3780i.h | 2 +-
drivers/char/random.c | 19 +-
drivers/char/tpm/tpm-chip.c | 18 +-
drivers/char/tpm/tpm_tis_core.c | 14 +-
drivers/clk/bcm/clk-bcm2835.c | 13 +-
drivers/clk/clk-bm1880.c | 20 +-
drivers/clk/clk-si5341.c | 2 +-
drivers/clk/clk-stm32f4.c | 4 -
drivers/clk/clk.c | 18 +
drivers/clk/imx/clk-imx8mn.c | 6 +-
drivers/clk/meson/gxbb.c | 44 +-
drivers/clk/qcom/gcc-sc7280.c | 2 +-
drivers/clk/renesas/rzg2l-cpg.c | 17 +-
drivers/cpufreq/cpufreq.c | 4 +-
drivers/cpufreq/qcom-cpufreq-hw.c | 7 +-
drivers/crypto/atmel-aes.c | 6 +-
drivers/crypto/caam/caamalg.c | 6 +
drivers/crypto/caam/caamalg_qi2.c | 2 +-
drivers/crypto/caam/caamhash.c | 3 +
drivers/crypto/caam/caampkc.c | 3 +
drivers/crypto/ccp/sev-dev.c | 30 +-
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +-
drivers/crypto/hisilicon/qm.c | 2 +-
drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c | 9 +-
.../crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 3 +-
drivers/crypto/omap-aes.c | 2 +-
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 45 +-
drivers/crypto/qce/aead.c | 2 +-
drivers/crypto/qce/sha.c | 2 +-
drivers/crypto/qce/skcipher.c | 2 +-
drivers/crypto/stm32/stm32-crc32.c | 4 +-
drivers/crypto/stm32/stm32-cryp.c | 938 ++++++++-------------
drivers/crypto/stm32/stm32-hash.c | 6 +-
drivers/cxl/pmem.c | 17 +-
drivers/dma-buf/dma-fence-array.c | 6 +-
drivers/dma/at_xdmac.c | 57 +-
drivers/dma/idxd/device.c | 12 +-
drivers/dma/mmp_pdma.c | 6 -
drivers/dma/pxa_dma.c | 7 -
drivers/dma/stm32-mdma.c | 2 +-
drivers/dma/uniphier-xdmac.c | 5 +-
drivers/edac/synopsys_edac.c | 3 +-
drivers/firmware/efi/efi-init.c | 5 +
drivers/firmware/google/Kconfig | 6 +-
drivers/firmware/sysfb_simplefb.c | 8 +-
drivers/gpio/gpio-aspeed-sgpio.c | 32 +-
drivers/gpio/gpio-aspeed.c | 52 +-
drivers/gpio/gpio-idt3243x.c | 4 +-
drivers/gpio/gpio-mpc8xxx.c | 4 +-
drivers/gpio/gpiolib-acpi.c | 15 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 +
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 -
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 +
drivers/gpu/drm/amd/amdgpu/cik.c | 4 +
drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 4 +
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 13 +-
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 +
drivers/gpu/drm/amd/amdgpu/vi.c | 4 +
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 138 ++-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +
.../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +-
drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 3 +-
drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +-
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 2 +
.../gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 3 +-
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 6 +
drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c | 14 +-
drivers/gpu/drm/bridge/display-connector.c | 2 +-
.../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 40 +-
.../gpu/drm/bridge/synopsys/dw-hdmi-ahb-audio.c | 10 +-
drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h | 4 +-
.../gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c | 9 +-
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 12 +-
drivers/gpu/drm/bridge/ti-sn65dsi86.c | 1 +
drivers/gpu/drm/drm_dp_helper.c | 40 +-
drivers/gpu/drm/drm_drv.c | 9 +-
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 +
drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 6 +
drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 1 +
drivers/gpu/drm/etnaviv/etnaviv_sched.c | 4 +-
drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c | 10 +-
drivers/gpu/drm/lima/lima_device.c | 1 +
drivers/gpu/drm/msm/Kconfig | 1 +
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +-
drivers/gpu/drm/msm/dsi/dsi.c | 10 +-
drivers/gpu/drm/msm/dsi/dsi.h | 1 -
drivers/gpu/drm/msm/dsi/dsi_manager.c | 17 -
drivers/gpu/drm/msm/msm_gem_submit.c | 2 +-
drivers/gpu/drm/nouveau/dispnv04/disp.c | 4 +-
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 +-
.../gpu/drm/panel/panel-feiyang-fy07024di26a30d.c | 8 +-
drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +-
drivers/gpu/drm/panel/panel-jdi-lt070me05000.c | 8 +-
drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c | 8 +-
drivers/gpu/drm/panel/panel-novatek-nt36672a.c | 8 +-
.../gpu/drm/panel/panel-panasonic-vvx10f034n00.c | 8 +-
drivers/gpu/drm/panel/panel-ronbo-rb070d30.c | 8 +-
.../drm/panel/panel-samsung-s6e88a0-ams452ef01.c | 1 +
drivers/gpu/drm/panel/panel-samsung-sofef00.c | 1 +
drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c | 8 +-
drivers/gpu/drm/radeon/radeon_kms.c | 42 +-
drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 20 +-
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 82 +-
drivers/gpu/drm/tegra/drm.c | 15 +
drivers/gpu/drm/tegra/gr2d.c | 33 +-
drivers/gpu/drm/tegra/submit.c | 4 +-
drivers/gpu/drm/tegra/vic.c | 7 +-
drivers/gpu/drm/ttm/ttm_bo.c | 2 +
drivers/gpu/drm/vboxvideo/vbox_main.c | 4 +-
drivers/gpu/drm/vc4/vc4_crtc.c | 31 +-
drivers/gpu/drm/vc4/vc4_drv.h | 29 +-
drivers/gpu/drm/vc4/vc4_hdmi.c | 136 ++-
drivers/gpu/drm/vc4/vc4_hvs.c | 26 +-
drivers/gpu/drm/vc4/vc4_kms.c | 3 +-
drivers/gpu/drm/vc4/vc4_txp.c | 4 +-
drivers/gpu/drm/vmwgfx/Makefile | 3 +-
drivers/gpu/drm/vmwgfx/ttm_memory.c | 99 +--
drivers/gpu/drm/vmwgfx/ttm_memory.h | 6 +-
drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c | 7 +
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 48 +-
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 20 +-
drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 12 +-
drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 4 +-
drivers/gpu/drm/vmwgfx/vmwgfx_system_manager.c | 90 ++
drivers/gpu/drm/vmwgfx/vmwgfx_thp.c | 184 ----
drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 58 +-
drivers/gpu/host1x/Kconfig | 1 +
drivers/gpu/host1x/dev.c | 15 +
drivers/hid/hid-apple.c | 2 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 8 +
drivers/hid/hid-magicmouse.c | 95 ++-
drivers/hid/hid-uclogic-params.c | 31 +-
drivers/hid/hid-vivaldi.c | 34 +-
drivers/hid/i2c-hid/i2c-hid-acpi.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-core.c | 4 +-
drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-of.c | 10 +-
drivers/hid/i2c-hid/i2c-hid.h | 2 +-
drivers/hid/uhid.c | 29 +-
drivers/hid/wacom_wac.c | 39 +-
drivers/hsi/hsi_core.c | 1 +
drivers/hwmon/mr75203.c | 2 +-
drivers/i2c/busses/i2c-designware-pcidrv.c | 8 +-
drivers/i2c/busses/i2c-i801.c | 15 +-
drivers/i2c/busses/i2c-mpc.c | 23 +-
drivers/iio/adc/ti-adc081c.c | 22 +-
drivers/iio/industrialio-trigger.c | 36 +-
drivers/infiniband/core/cma.c | 18 +-
drivers/infiniband/core/device.c | 3 +-
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 6 +-
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 1 -
drivers/infiniband/hw/cxgb4/qp.c | 1 +
drivers/infiniband/hw/hns/hns_roce_main.c | 5 +-
drivers/infiniband/hw/qedr/verbs.c | 2 +
drivers/infiniband/sw/rxe/rxe_opcode.c | 2 +-
drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
drivers/interconnect/qcom/icc-rpm.c | 1 +
drivers/iommu/amd/amd_iommu_types.h | 2 -
drivers/iommu/amd/init.c | 107 +--
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 2 +-
drivers/iommu/io-pgtable-arm-v7s.c | 6 +-
drivers/iommu/io-pgtable-arm.c | 9 +-
drivers/iommu/iommu.c | 3 +-
drivers/iommu/iova.c | 3 +-
drivers/irqchip/irq-gic-v3.c | 16 +
drivers/leds/leds-lp55xx-common.c | 4 +-
drivers/mailbox/mailbox-mpfs.c | 2 +-
drivers/mailbox/mtk-cmdq-mailbox.c | 2 +-
drivers/md/dm.c | 4 +-
drivers/md/md.c | 27 +-
drivers/md/md.h | 2 +
drivers/md/persistent-data/dm-btree.c | 8 +-
drivers/md/persistent-data/dm-space-map-common.c | 5 +
drivers/md/raid0.c | 38 +-
drivers/md/raid5.c | 41 +-
drivers/media/Kconfig | 8 +-
drivers/media/cec/core/cec-adap.c | 38 +-
drivers/media/cec/core/cec-api.c | 6 +
drivers/media/cec/core/cec-core.c | 3 +
drivers/media/cec/core/cec-pin.c | 31 +-
drivers/media/common/saa7146/saa7146_fops.c | 2 +-
.../media/common/videobuf2/videobuf2-dma-contig.c | 8 +-
drivers/media/dvb-core/dmxdev.c | 18 +-
drivers/media/dvb-frontends/dib8000.c | 4 +-
drivers/media/i2c/imx274.c | 5 +
drivers/media/i2c/ov8865.c | 16 +-
drivers/media/pci/b2c2/flexcop-pci.c | 3 +
drivers/media/pci/saa7146/hexium_gemini.c | 7 +-
drivers/media/pci/saa7146/hexium_orion.c | 8 +-
drivers/media/pci/saa7146/mxb.c | 8 +-
drivers/media/platform/aspeed-video.c | 14 +-
drivers/media/platform/coda/coda-common.c | 8 +-
drivers/media/platform/coda/coda-jpeg.c | 21 +-
drivers/media/platform/coda/imx-vdoa.c | 6 +-
drivers/media/platform/imx-pxp.c | 4 +-
.../media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +-
drivers/media/platform/qcom/venus/core.c | 11 +-
drivers/media/platform/qcom/venus/pm_helpers.c | 32 +-
drivers/media/platform/rcar-vin/rcar-csi2.c | 18 +-
drivers/media/platform/rcar-vin/rcar-v4l2.c | 15 +-
.../media/platform/rockchip/rkisp1/rkisp1-dev.c | 2 +-
drivers/media/radio/si470x/radio-si470x-i2c.c | 3 +-
drivers/media/rc/igorplugusb.c | 4 +-
drivers/media/rc/mceusb.c | 8 +-
drivers/media/rc/redrat3.c | 22 +-
drivers/media/tuners/msi001.c | 7 +
drivers/media/tuners/si2157.c | 2 +-
drivers/media/usb/b2c2/flexcop-usb.c | 10 +-
drivers/media/usb/b2c2/flexcop-usb.h | 12 +-
drivers/media/usb/cpia2/cpia2_usb.c | 4 +-
drivers/media/usb/dvb-usb/dib0700_core.c | 2 -
drivers/media/usb/dvb-usb/dw2102.c | 338 +++++---
drivers/media/usb/dvb-usb/m920x.c | 12 +-
drivers/media/usb/em28xx/em28xx-cards.c | 18 +-
drivers/media/usb/em28xx/em28xx-core.c | 4 +-
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 +-
drivers/media/usb/s2255/s2255drv.c | 4 +-
drivers/media/usb/stk1160/stk1160-core.c | 4 +-
drivers/media/usb/uvc/uvcvideo.h | 2 +-
drivers/media/v4l2-core/v4l2-ioctl.c | 4 +-
drivers/memory/renesas-rpc-if.c | 2 +-
drivers/mfd/atmel-flexcom.c | 11 +-
drivers/mfd/tps65910.c | 22 +-
drivers/misc/eeprom/at25.c | 13 +-
drivers/misc/habanalabs/common/firmware_if.c | 17 +-
drivers/misc/habanalabs/common/habanalabs.h | 2 +
drivers/misc/lattice-ecp3-config.c | 12 +-
drivers/misc/lkdtm/Makefile | 2 +-
drivers/misc/mei/hbm.c | 20 +-
drivers/mmc/core/sdio.c | 4 +-
drivers/mmc/host/meson-mx-sdhc-mmc.c | 5 +
drivers/mmc/host/meson-mx-sdio.c | 5 +
drivers/mmc/host/mtk-sd.c | 64 +-
drivers/mmc/host/sdhci-pci-gli.c | 11 +
drivers/mmc/host/tmio_mmc_core.c | 15 +-
drivers/mtd/hyperbus/rpc-if.c | 8 +-
drivers/mtd/mtdcore.c | 4 +-
drivers/mtd/mtdpart.c | 2 +-
drivers/mtd/nand/raw/davinci_nand.c | 73 +-
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 37 +-
drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c | 5 +
drivers/mtd/nand/raw/nand_base.c | 67 ++
drivers/net/bonding/bond_main.c | 40 +-
drivers/net/can/flexcan.c | 150 ++--
drivers/net/can/rcar/rcar_canfd.c | 5 +-
drivers/net/can/softing/softing_cs.c | 2 +-
drivers/net/can/softing/softing_fw.c | 11 +-
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 6 +-
drivers/net/can/xilinx_can.c | 7 +-
drivers/net/dsa/hirschmann/hellcreek.c | 87 +-
drivers/net/ethernet/broadcom/bnxt/Makefile | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c | 372 ++++++++
drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.h | 51 ++
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 355 +-------
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h | 43 -
drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.h | 3 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 +-
drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | 3 +-
drivers/net/ethernet/cortina/gemini.c | 9 +-
drivers/net/ethernet/freescale/fman/mac.c | 21 +-
drivers/net/ethernet/freescale/xgmac_mdio.c | 28 +-
drivers/net/ethernet/i825xx/sni_82596.c | 3 +-
drivers/net/ethernet/intel/igc/igc_main.c | 4 +-
drivers/net/ethernet/marvell/octeontx2/af/ptp.c | 2 +
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 55 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 16 +-
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 36 +-
.../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 5 +-
.../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 2 +
.../net/ethernet/mellanox/mlx5/core/en/xsk/pool.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 3 +
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 120 ++-
.../net/ethernet/mellanox/mlx5/core/esw/legacy.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 6 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 +-
.../net/ethernet/mellanox/mlx5/core/sf/dev/dev.c | 5 +-
drivers/net/ethernet/mellanox/mlxsw/cmd.h | 12 +
drivers/net/ethernet/mellanox/mlxsw/pci.c | 7 +-
drivers/net/ethernet/mscc/ocelot.c | 31 +-
drivers/net/ethernet/mscc/ocelot_flower.c | 15 +-
drivers/net/ethernet/mscc/ocelot_net.c | 6 +-
drivers/net/ethernet/renesas/ravb_main.c | 6 +-
drivers/net/ethernet/rocker/rocker_ofdpa.c | 3 +-
.../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 7 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +
drivers/net/ethernet/ti/cpsw.c | 6 +-
drivers/net/ethernet/ti/cpsw_new.c | 6 +-
drivers/net/ethernet/ti/cpsw_priv.c | 2 +-
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 135 +--
drivers/net/ipa/ipa_endpoint.c | 7 +-
drivers/net/phy/marvell.c | 62 +-
drivers/net/phy/mdio_bus.c | 2 +-
drivers/net/phy/micrel.c | 36 +-
drivers/net/phy/phy-core.c | 2 +-
drivers/net/phy/sfp.c | 25 +-
drivers/net/ppp/ppp_generic.c | 7 +-
drivers/net/usb/mcs7830.c | 12 +-
drivers/net/usb/smsc95xx.c | 3 +-
drivers/net/wireless/ath/ar5523/ar5523.c | 4 +
drivers/net/wireless/ath/ath10k/core.c | 19 +-
drivers/net/wireless/ath/ath10k/htt_tx.c | 3 +
drivers/net/wireless/ath/ath10k/hw.h | 3 +
drivers/net/wireless/ath/ath10k/txrx.c | 2 -
drivers/net/wireless/ath/ath11k/ahb.c | 28 +-
drivers/net/wireless/ath/ath11k/core.c | 27 +-
drivers/net/wireless/ath/ath11k/core.h | 15 +-
drivers/net/wireless/ath/ath11k/dp.h | 3 +-
drivers/net/wireless/ath/ath11k/dp_tx.c | 2 +-
drivers/net/wireless/ath/ath11k/hal.c | 22 +
drivers/net/wireless/ath/ath11k/hal.h | 2 +
drivers/net/wireless/ath/ath11k/hw.c | 2 -
drivers/net/wireless/ath/ath11k/mac.c | 52 +-
drivers/net/wireless/ath/ath11k/pci.c | 22 +-
drivers/net/wireless/ath/ath11k/qmi.c | 2 +-
drivers/net/wireless/ath/ath11k/reg.c | 103 +--
drivers/net/wireless/ath/ath11k/wmi.c | 5 +-
drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +
drivers/net/wireless/ath/ath9k/htc.h | 2 +
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 13 +
drivers/net/wireless/ath/ath9k/wmi.c | 4 +
drivers/net/wireless/ath/wcn36xx/dxe.c | 49 +-
drivers/net/wireless/ath/wcn36xx/main.c | 34 +-
drivers/net/wireless/ath/wcn36xx/smd.c | 10 +-
drivers/net/wireless/ath/wcn36xx/txrx.c | 41 +-
drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 +
drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 5 +-
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 17 +-
drivers/net/wireless/intel/iwlwifi/iwl-io.c | 2 +-
.../net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 4 +-
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 17 +
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 27 +
drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 23 +-
.../net/wireless/intel/iwlwifi/mvm/time-event.c | 36 +-
drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 7 +-
drivers/net/wireless/intel/iwlwifi/queue/tx.c | 1 +
drivers/net/wireless/marvell/mwifiex/sta_event.c | 8 +-
drivers/net/wireless/marvell/mwifiex/usb.c | 3 +-
drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 4 +
drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 9 +-
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 8 +-
.../net/wireless/mediatek/mt76/mt7615/pci_init.c | 8 +-
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 9 +-
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 9 +-
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 6 -
drivers/net/wireless/microchip/wilc1000/netdev.c | 1 -
drivers/net/wireless/microchip/wilc1000/sdio.c | 2 +
drivers/net/wireless/microchip/wilc1000/spi.c | 2 +
drivers/net/wireless/realtek/rtw88/main.c | 2 +-
drivers/net/wireless/realtek/rtw88/pci.c | 61 +-
drivers/net/wireless/realtek/rtw88/pci.h | 2 +
drivers/net/wireless/realtek/rtw88/rtw8821c.h | 2 +-
drivers/net/wireless/realtek/rtw88/rtw8822b.c | 2 +-
drivers/net/wireless/realtek/rtw88/rtw8822c.c | 2 +-
drivers/net/wireless/rsi/rsi_91x_main.c | 4 +
drivers/net/wireless/rsi/rsi_91x_usb.c | 9 +-
drivers/net/wireless/rsi/rsi_usb.h | 2 +
drivers/net/wwan/mhi_wwan_mbim.c | 4 +-
drivers/nvmem/core.c | 2 +
drivers/of/base.c | 11 +-
drivers/of/fdt.c | 25 +-
drivers/of/unittest.c | 21 +-
drivers/parisc/pdc_stable.c | 4 +-
drivers/pci/controller/pci-aardvark.c | 4 +-
drivers/pci/controller/pci-mvebu.c | 8 +
drivers/pci/controller/pci-xgene.c | 2 +-
drivers/pci/hotplug/pciehp.h | 3 +
drivers/pci/hotplug/pciehp_core.c | 2 +-
drivers/pci/hotplug/pciehp_hpc.c | 28 +-
drivers/pci/msi.c | 26 +-
drivers/pci/pci-bridge-emul.c | 70 +-
drivers/pci/quirks.c | 3 +
drivers/pcmcia/cs.c | 8 +-
drivers/pcmcia/rsrc_nonstatic.c | 6 +
drivers/perf/arm-cmn.c | 5 +-
drivers/phy/cadence/phy-cadence-sierra.c | 31 +-
drivers/phy/mediatek/phy-mtk-mipi-dsi.c | 2 +
drivers/phy/mediatek/phy-mtk-tphy.c | 162 ++++
drivers/phy/socionext/phy-uniphier-usb3ss.c | 10 +-
drivers/pinctrl/pinctrl-rockchip.c | 2 +-
drivers/power/reset/mt6323-poweroff.c | 3 +
drivers/ptp/ptp_vclock.c | 10 +-
drivers/regulator/da9121-regulator.c | 5 +
drivers/regulator/qcom-labibb-regulator.c | 2 +-
drivers/regulator/qcom_smd-regulator.c | 100 ++-
drivers/remoteproc/imx_rproc.c | 1 +
drivers/rpmsg/rpmsg_core.c | 20 +-
drivers/rtc/rtc-cmos.c | 3 +
drivers/rtc/rtc-pxa.c | 4 +
drivers/scsi/lpfc/lpfc.h | 2 +-
drivers/scsi/lpfc/lpfc_attr.c | 62 +-
drivers/scsi/lpfc/lpfc_els.c | 11 +-
drivers/scsi/lpfc/lpfc_hbadisc.c | 8 +-
drivers/scsi/lpfc/lpfc_init.c | 8 +-
drivers/scsi/lpfc/lpfc_nportdisc.c | 6 +
drivers/scsi/lpfc/lpfc_sli.c | 6 -
drivers/scsi/mpi3mr/mpi3mr.h | 3 +-
drivers/scsi/mpi3mr/mpi3mr_fw.c | 4 +-
drivers/scsi/pm8001/pm8001_hwi.c | 4 +-
drivers/scsi/scsi.c | 4 +-
drivers/scsi/scsi_debugfs.c | 1 +
drivers/scsi/scsi_pm.c | 2 +-
drivers/scsi/sr.c | 2 +-
drivers/scsi/sr_vendor.c | 4 +-
drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 -
drivers/scsi/ufs/ufs-mediatek.c | 2 +-
drivers/scsi/ufs/ufshcd-pci.c | 2 -
drivers/scsi/ufs/ufshcd-pltfrm.c | 2 -
drivers/scsi/ufs/ufshcd.c | 22 +-
drivers/soc/imx/gpcv2.c | 2 +-
drivers/soc/mediatek/mtk-scpsys.c | 15 +-
drivers/soc/qcom/cpr.c | 2 +-
drivers/soc/ti/pruss.c | 2 +-
drivers/spi/spi-hisi-kunpeng.c | 15 +-
drivers/spi/spi-meson-spifc.c | 1 +
drivers/spi/spi-uniphier.c | 11 +-
drivers/spi/spi.c | 13 +-
drivers/staging/greybus/audio_topology.c | 15 +
drivers/staging/media/atomisp/i2c/ov2680.h | 24 -
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 82 +-
drivers/staging/media/atomisp/pci/atomisp_fops.c | 11 +
.../media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 188 ++++-
drivers/staging/media/atomisp/pci/atomisp_subdev.c | 15 +-
drivers/staging/media/atomisp/pci/atomisp_subdev.h | 3 +
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 13 +-
drivers/staging/media/atomisp/pci/atomisp_v4l2.h | 3 +-
drivers/staging/media/atomisp/pci/sh_css.c | 27 +-
drivers/staging/media/atomisp/pci/sh_css_mipi.c | 41 +-
drivers/staging/media/atomisp/pci/sh_css_params.c | 8 +-
drivers/staging/media/hantro/hantro_drv.c | 3 +-
drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +-
drivers/staging/media/hantro/hantro_hw.h | 3 +-
.../media/hantro/rockchip_vpu2_hw_jpeg_enc.c | 17 +
drivers/staging/media/hantro/rockchip_vpu_hw.c | 5 +-
drivers/staging/rtl8192e/rtllib.h | 2 +-
drivers/staging/rtl8192e/rtllib_module.c | 16 +-
drivers/staging/rtl8192e/rtllib_softmac.c | 6 +-
drivers/tee/tee_core.c | 4 +-
drivers/thermal/imx8mm_thermal.c | 3 +
drivers/thermal/imx_thermal.c | 145 ++--
drivers/thunderbolt/acpi.c | 13 +
drivers/tty/mxser.c | 5 +-
drivers/tty/serial/8250/8250_bcm7271.c | 11 +-
drivers/tty/serial/amba-pl010.c | 3 -
drivers/tty/serial/amba-pl011.c | 29 +-
drivers/tty/serial/atmel_serial.c | 14 +
drivers/tty/serial/imx.c | 7 +-
drivers/tty/serial/liteuart.c | 2 +-
drivers/tty/serial/serial_core.c | 7 +-
drivers/tty/serial/stm32-usart.c | 6 +-
drivers/tty/serial/uartlite.c | 2 +-
drivers/uio/uio_dmem_genirq.c | 6 +-
drivers/usb/core/hub.c | 5 +-
drivers/usb/dwc2/gadget.c | 13 +-
drivers/usb/dwc2/hcd.c | 7 +-
drivers/usb/dwc3/dwc3-meson-g12a.c | 17 +-
drivers/usb/dwc3/dwc3-qcom.c | 7 +-
drivers/usb/gadget/function/f_fs.c | 4 +-
drivers/usb/gadget/function/u_audio.c | 4 +-
drivers/usb/host/ehci-brcm.c | 6 +-
drivers/usb/host/uhci-platform.c | 3 +-
drivers/usb/misc/ftdi-elan.c | 1 +
drivers/vdpa/ifcvf/ifcvf_base.c | 41 +-
drivers/vdpa/ifcvf/ifcvf_base.h | 9 +-
drivers/vdpa/ifcvf/ifcvf_main.c | 24 +-
drivers/vdpa/mlx5/net/mlx5_vnet.c | 6 +-
drivers/video/backlight/qcom-wled.c | 122 +--
drivers/virtio/virtio_mem.c | 2 +-
drivers/virtio/virtio_ring.c | 4 +-
drivers/w1/slaves/w1_ds28e04.c | 26 +-
drivers/xen/gntdev.c | 6 +-
fs/btrfs/backref.c | 21 +-
fs/btrfs/ctree.c | 19 +-
fs/btrfs/inode.c | 11 +
fs/btrfs/qgroup.c | 19 +
fs/debugfs/file.c | 2 +-
fs/dlm/lock.c | 9 +
fs/dlm/lowcomms.c | 44 +-
fs/ext4/ext4.h | 1 +
fs/ext4/ext4_jbd2.c | 2 +
fs/ext4/extents.c | 2 -
fs/ext4/fast_commit.c | 18 +-
fs/ext4/inode.c | 51 +-
fs/ext4/ioctl.c | 2 -
fs/ext4/mballoc.c | 48 +-
fs/ext4/migrate.c | 23 +-
fs/ext4/super.c | 27 +-
fs/f2fs/checkpoint.c | 4 +-
fs/f2fs/compress.c | 50 +-
fs/f2fs/data.c | 7 +-
fs/f2fs/f2fs.h | 11 +
fs/f2fs/file.c | 10 +-
fs/f2fs/gc.c | 8 +-
fs/f2fs/inode.c | 5 +
fs/f2fs/segment.h | 3 +-
fs/f2fs/super.c | 44 +
fs/f2fs/sysfs.c | 4 +-
fs/fuse/file.c | 2 +-
fs/io_uring.c | 1 +
fs/jffs2/file.c | 40 +-
fs/ksmbd/connection.c | 1 +
fs/ksmbd/connection.h | 4 +-
fs/ksmbd/ksmbd_netlink.h | 12 +-
fs/ksmbd/smb2misc.c | 18 +-
fs/ksmbd/smb2ops.c | 16 +-
fs/ksmbd/smb2pdu.c | 87 +-
fs/ksmbd/smb2pdu.h | 1 +
fs/ksmbd/smb_common.h | 1 +
fs/ksmbd/transport_ipc.c | 2 +
fs/ksmbd/transport_tcp.c | 3 +-
fs/ubifs/super.c | 1 -
fs/udf/ialloc.c | 2 +
include/acpi/acpi_bus.h | 5 +-
include/acpi/actypes.h | 10 +-
include/asm-generic/bitops/find.h | 5 +
include/linux/blk-pm.h | 2 +-
include/linux/bpf_verifier.h | 7 +
include/linux/hid.h | 2 +
include/linux/iio/trigger.h | 2 +
include/linux/ipv6.h | 2 +
include/linux/mmzone.h | 9 +
include/linux/mtd/rawnand.h | 2 +
include/linux/of_fdt.h | 2 +
include/linux/pm_runtime.h | 3 +
include/linux/psi_types.h | 13 +-
include/linux/ptp_clock_kernel.h | 12 +-
include/linux/skbuff.h | 7 +-
include/linux/stmmac.h | 1 +
include/media/cec.h | 11 +-
include/net/inet_frag.h | 11 +-
include/net/ipv6_frag.h | 3 +-
include/net/pkt_sched.h | 5 +-
include/net/sch_generic.h | 5 +
include/net/seg6.h | 21 +
include/net/xfrm.h | 7 +-
include/sound/hda_codec.h | 8 +-
include/trace/events/cgroup.h | 12 +-
include/uapi/linux/xfrm.h | 1 +
kernel/audit.c | 18 +-
kernel/bpf/btf.c | 3 +-
kernel/bpf/inode.c | 14 +-
kernel/bpf/verifier.c | 28 +-
kernel/dma/pool.c | 4 +-
kernel/rcu/rcutorture.c | 5 +
kernel/rcu/tree_exp.h | 1 +
kernel/sched/cpuacct.c | 79 +-
kernel/sched/cputime.c | 4 +-
kernel/sched/fair.c | 4 +-
kernel/sched/psi.c | 45 +-
kernel/sched/rt.c | 23 +-
kernel/sched/stats.h | 5 +-
kernel/time/clocksource.c | 50 +-
kernel/trace/bpf_trace.c | 6 +-
kernel/trace/trace_kprobe.c | 5 +-
kernel/trace/trace_osnoise.c | 20 +-
kernel/trace/trace_syscalls.c | 6 +-
kernel/tsacct.c | 7 +-
lib/kunit/test.c | 18 +-
lib/logic_iomem.c | 19 +-
lib/mpi/mpi-mod.c | 2 +
lib/test_hmm.c | 24 +
lib/test_meminit.c | 1 +
mm/hmm.c | 5 +-
mm/page_alloc.c | 19 +-
mm/shmem.c | 37 +-
net/ax25/af_ax25.c | 10 +-
net/batman-adv/netlink.c | 30 +-
net/bluetooth/cmtp/core.c | 4 +-
net/bluetooth/hci_core.c | 1 +
net/bluetooth/hci_event.c | 14 +-
net/bluetooth/hci_request.c | 2 +-
net/bluetooth/hci_sysfs.c | 2 +
net/bluetooth/l2cap_sock.c | 45 +-
net/bluetooth/mgmt.c | 248 +++---
net/bridge/br_netfilter_hooks.c | 7 +-
net/core/dev.c | 6 +
net/core/devlink.c | 2 -
net/core/filter.c | 8 +-
net/core/flow_dissector.c | 3 +-
net/core/net-sysfs.c | 3 +
net/core/net_namespace.c | 4 +-
net/core/sock.c | 2 +
net/core/sock_map.c | 21 +-
net/dsa/switch.c | 4 +-
net/ipv4/fib_semantics.c | 47 +-
net/ipv4/inet_fragment.c | 8 +-
net/ipv4/ip_fragment.c | 3 +-
net/ipv4/ip_gre.c | 5 +-
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +-
net/ipv4/tcp_bpf.c | 27 +
net/ipv6/icmp.c | 6 +-
net/ipv6/ip6_gre.c | 5 +-
net/ipv6/seg6.c | 59 ++
net/ipv6/seg6_local.c | 33 +-
net/ipv6/udp.c | 3 +-
net/mac80211/rx.c | 2 +-
net/mptcp/options.c | 10 +-
net/mptcp/pm_netlink.c | 18 +-
net/netfilter/nft_payload.c | 3 +
net/netfilter/nft_set_pipapo.c | 8 +
net/netrom/af_netrom.c | 12 +-
net/nfc/llcp_sock.c | 5 +
net/openvswitch/flow.c | 20 +-
net/sched/act_ct.c | 7 +
net/sched/cls_api.c | 3 +
net/sched/cls_flower.c | 3 +-
net/sched/sch_api.c | 2 +-
net/sched/sch_generic.c | 1 +
net/smc/af_smc.c | 8 +-
net/smc/smc_core.c | 29 +-
net/smc/smc_core.h | 2 +-
net/socket.c | 9 +-
net/unix/garbage.c | 14 +-
net/unix/scm.c | 6 +-
net/xfrm/xfrm_compat.c | 6 +-
net/xfrm/xfrm_interface.c | 14 +-
net/xfrm/xfrm_output.c | 30 +-
net/xfrm/xfrm_policy.c | 24 +-
net/xfrm/xfrm_state.c | 23 +-
net/xfrm/xfrm_user.c | 41 +-
samples/bpf/Makefile | 56 +-
samples/bpf/Makefile.target | 11 -
samples/bpf/hbm_kern.h | 2 -
samples/bpf/lwt_len_hist_kern.c | 7 -
samples/bpf/xdp_sample_user.h | 2 +
scripts/dtc/dtx_diff | 8 +-
scripts/sphinx-pre-install | 3 +
security/selinux/hooks.c | 12 +-
sound/core/jack.c | 3 +
sound/core/misc.c | 2 +-
sound/core/oss/pcm_oss.c | 2 +-
sound/core/pcm.c | 6 +-
sound/core/seq/seq_queue.c | 14 +-
sound/hda/hdac_stream.c | 14 +-
sound/pci/hda/hda_bind.c | 5 +
sound/pci/hda/hda_codec.c | 45 +-
sound/pci/hda/hda_controller.c | 1 -
sound/pci/hda/hda_local.h | 1 +
sound/pci/hda/patch_cs8409-tables.c | 3 +
sound/pci/hda/patch_cs8409.c | 9 +-
sound/pci/hda/patch_cs8409.h | 1 +
sound/soc/codecs/Kconfig | 3 +-
sound/soc/codecs/rt5663.c | 12 +-
sound/soc/fsl/fsl_asrc.c | 69 +-
sound/soc/fsl/fsl_mqs.c | 2 +-
sound/soc/fsl/imx-card.c | 32 +-
sound/soc/fsl/imx-hdmi.c | 2 +
sound/soc/intel/boards/sof_sdw.c | 2 +-
sound/soc/intel/catpt/dsp.c | 14 +-
sound/soc/intel/skylake/skl-pcm.c | 1 -
sound/soc/mediatek/mt8173/mt8173-max98090.c | 3 +
sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 +
sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 +
sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 +
sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c | 6 +-
.../mt8183/mt8183-mt6358-ts3a227-max98357.c | 7 +-
.../mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 6 +-
sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 2 +-
sound/soc/mediatek/mt8195/mt8195-dai-pcm.c | 73 +-
sound/soc/mediatek/mt8195/mt8195-reg.h | 1 +
sound/soc/samsung/idma.c | 2 +
sound/soc/uniphier/Kconfig | 2 -
sound/usb/format.c | 2 +-
sound/usb/mixer_quirks.c | 2 +-
sound/usb/quirks.c | 2 +-
tools/bpf/bpftool/Documentation/Makefile | 1 -
tools/bpf/bpftool/Documentation/bpftool-btf.rst | 2 +-
tools/bpf/bpftool/Documentation/bpftool-cgroup.rst | 2 +-
tools/bpf/bpftool/Documentation/bpftool-gen.rst | 2 +-
tools/bpf/bpftool/Documentation/bpftool-link.rst | 2 +-
tools/bpf/bpftool/Documentation/bpftool-map.rst | 6 +-
tools/bpf/bpftool/Documentation/bpftool-prog.rst | 8 +-
tools/bpf/bpftool/Documentation/bpftool.rst | 6 +-
tools/bpf/bpftool/Makefile | 1 -
tools/bpf/bpftool/main.c | 2 +
tools/bpf/bpftool/prog.c | 15 +-
tools/include/nolibc/nolibc.h | 33 +-
tools/lib/bpf/btf.c | 55 +-
tools/lib/bpf/btf.h | 2 +-
tools/lib/bpf/btf_dump.c | 2 +-
tools/lib/bpf/gen_loader.c | 4 +-
tools/lib/bpf/libbpf.c | 9 +-
tools/lib/bpf/linker.c | 6 +-
tools/perf/Makefile.config | 5 +-
tools/perf/util/debug.c | 2 +-
tools/perf/util/evsel.c | 25 +-
tools/perf/util/probe-event.c | 3 +
tools/testing/selftests/bpf/btf_helpers.c | 9 +-
tools/testing/selftests/bpf/prog_tests/bpf_iter.c | 5 +-
.../selftests/bpf/prog_tests/migrate_reuseport.c | 4 +-
tools/testing/selftests/bpf/prog_tests/skb_ctx.c | 2 +
.../testing/selftests/bpf/prog_tests/tc_redirect.c | 7 +
tools/testing/selftests/clone3/clone3.c | 6 +
.../selftests/ftrace/test.d/kprobe/profile.tc | 2 +-
tools/testing/selftests/kselftest_harness.h | 2 +-
.../selftests/powerpc/security/spectre_v2.c | 2 +-
tools/testing/selftests/powerpc/signal/.gitignore | 1 +
tools/testing/selftests/powerpc/signal/Makefile | 1 +
.../selftests/powerpc/signal/sigreturn_kernel.c | 132 +++
tools/testing/selftests/vm/hmm-tests.c | 42 +
896 files changed, 9019 insertions(+), 5115 deletions(-)
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 001/846] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.15 002/846] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock Greg Kroah-Hartman
` (848 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Matlack, Sean Christopherson,
Paolo Bonzini
From: David Matlack <dmatlack@google.com>
commit 7c8a4742c4abe205ec9daf416c9d42fd6b406e8e upstream.
When the TDP MMU is write-protection GFNs for page table protection (as
opposed to for dirty logging, or due to the HVA not being writable), it
checks if the SPTE is already write-protected and if so skips modifying
the SPTE and the TLB flush.
This behavior is incorrect because it fails to check if the SPTE
is write-protected for page table protection, i.e. fails to check
that MMU-writable is '0'. If the SPTE was write-protected for dirty
logging but not page table protection, the SPTE could locklessly be made
writable, and vCPUs could still be running with writable mappings cached
in their TLB.
Fix this by only skipping setting the SPTE if the SPTE is already
write-protected *and* MMU-writable is already clear. Technically,
checking only MMU-writable would suffice; a SPTE cannot be writable
without MMU-writable being set. But check both to be paranoid and
because it arguably yields more readable code.
Fixes: 46044f72c382 ("kvm: x86/mmu: Support write protection for nesting in tdp MMU")
Cc: stable@vger.kernel.org
Signed-off-by: David Matlack <dmatlack@google.com>
Message-Id: <20220113233020.3986005-2-dmatlack@google.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/tdp_mmu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/mmu/tdp_mmu.c
+++ b/arch/x86/kvm/mmu/tdp_mmu.c
@@ -1493,12 +1493,12 @@ static bool write_protect_gfn(struct kvm
!is_last_spte(iter.old_spte, iter.level))
continue;
- if (!is_writable_pte(iter.old_spte))
- break;
-
new_spte = iter.old_spte &
~(PT_WRITABLE_MASK | shadow_mmu_writable_mask);
+ if (new_spte == iter.old_spte)
+ break;
+
tdp_mmu_set_spte(kvm, &iter, new_spte);
spte_set = true;
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 002/846] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.15 001/846] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 003/846] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100 Greg Kroah-Hartman
` (847 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marcelo Tosatti, Paolo Bonzini
From: Marcelo Tosatti <mtosatti@redhat.com>
commit 5f02ef741a785678930f3ff0a8b6b2b0ef1bb402 upstream.
blocked_vcpu_on_cpu_lock is taken from hard interrupt context
(pi_wakeup_handler), therefore it cannot sleep.
Switch it to a raw spinlock.
Fixes:
[41297.066254] BUG: scheduling while atomic: CPU 0/KVM/635218/0x00010001
[41297.066323] Preemption disabled at:
[41297.066324] [<ffffffff902ee47f>] irq_enter_rcu+0xf/0x60
[41297.066339] Call Trace:
[41297.066342] <IRQ>
[41297.066346] dump_stack_lvl+0x34/0x44
[41297.066353] ? irq_enter_rcu+0xf/0x60
[41297.066356] __schedule_bug.cold+0x7d/0x8b
[41297.066361] __schedule+0x439/0x5b0
[41297.066365] ? task_blocks_on_rt_mutex.constprop.0.isra.0+0x1b0/0x440
[41297.066369] schedule_rtlock+0x1e/0x40
[41297.066371] rtlock_slowlock_locked+0xf1/0x260
[41297.066374] rt_spin_lock+0x3b/0x60
[41297.066378] pi_wakeup_handler+0x31/0x90 [kvm_intel]
[41297.066388] sysvec_kvm_posted_intr_wakeup_ipi+0x9d/0xd0
[41297.066392] </IRQ>
[41297.066392] asm_sysvec_kvm_posted_intr_wakeup_ipi+0x12/0x20
...
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/posted_intr.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -15,7 +15,7 @@
* can find which vCPU should be waken up.
*/
static DEFINE_PER_CPU(struct list_head, blocked_vcpu_on_cpu);
-static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock);
+static DEFINE_PER_CPU(raw_spinlock_t, blocked_vcpu_on_cpu_lock);
static inline struct pi_desc *vcpu_to_pi_desc(struct kvm_vcpu *vcpu)
{
@@ -121,9 +121,9 @@ static void __pi_post_block(struct kvm_v
new.control) != old.control);
if (!WARN_ON_ONCE(vcpu->pre_pcpu == -1)) {
- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+ raw_spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
list_del(&vcpu->blocked_vcpu_list);
- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+ raw_spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
vcpu->pre_pcpu = -1;
}
}
@@ -154,11 +154,11 @@ int pi_pre_block(struct kvm_vcpu *vcpu)
local_irq_disable();
if (!WARN_ON_ONCE(vcpu->pre_pcpu != -1)) {
vcpu->pre_pcpu = vcpu->cpu;
- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+ raw_spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
list_add_tail(&vcpu->blocked_vcpu_list,
&per_cpu(blocked_vcpu_on_cpu,
vcpu->pre_pcpu));
- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+ raw_spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
}
do {
@@ -215,7 +215,7 @@ void pi_wakeup_handler(void)
struct kvm_vcpu *vcpu;
int cpu = smp_processor_id();
- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+ raw_spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
list_for_each_entry(vcpu, &per_cpu(blocked_vcpu_on_cpu, cpu),
blocked_vcpu_list) {
struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
@@ -223,13 +223,13 @@ void pi_wakeup_handler(void)
if (pi_test_on(pi_desc) == 1)
kvm_vcpu_kick(vcpu);
}
- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+ raw_spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
}
void __init pi_init_cpu(int cpu)
{
INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
- spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+ raw_spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
}
bool pi_has_pending_interrupt(struct kvm_vcpu *vcpu)
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 003/846] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.15 001/846] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.15 002/846] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 004/846] HID: uhid: Fix worker destroying device without any protection Greg Kroah-Hartman
` (846 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Karl Kurbjun, Jiri Kosina
From: Karl Kurbjun <kkurbjun@gmail.com>
commit f3193ea1b6779023334faa72b214ece457e02656 upstream.
Battery status on Elan tablet driver is reported for the HP ENVY x360
15t-dr100. There is no separate battery for the Elan controller resulting in a
battery level report of 0% or 1% depending on whether a stylus has interacted
with the screen. These low battery level reports causes a variety of bad
behavior in desktop environments. This patch adds the appropriate quirk to
indicate that the batery status is unused for this target.
Cc: stable@vger.kernel.org
Signed-off-by: Karl Kurbjun <kkurbjun@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 2 ++
2 files changed, 3 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -394,6 +394,7 @@
#define USB_DEVICE_ID_HP_X2 0x074d
#define USB_DEVICE_ID_HP_X2_10_COVER 0x0755
#define I2C_DEVICE_ID_HP_SPECTRE_X360_15 0x2817
+#define I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100 0x29CF
#define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN 0x2544
#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706
#define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN 0x261A
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -327,6 +327,8 @@ static const struct hid_device_id hid_ba
HID_BATTERY_QUIRK_IGNORE },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN),
HID_BATTERY_QUIRK_IGNORE },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100),
+ HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_15),
HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN),
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 004/846] HID: uhid: Fix worker destroying device without any protection
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 003/846] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100 Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 005/846] HID: wacom: Reset expected and received contact counts at the same time Greg Kroah-Hartman
` (845 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jann Horn, Jiri Kosina
From: Jann Horn <jannh@google.com>
commit 4ea5763fb79ed89b3bdad455ebf3f33416a81624 upstream.
uhid has to run hid_add_device() from workqueue context while allowing
parallel use of the userspace API (which is protected with ->devlock).
But hid_add_device() can fail. Currently, that is handled by immediately
destroying the associated HID device, without using ->devlock - but if
there are concurrent requests from userspace, that's wrong and leads to
NULL dereferences and/or memory corruption (via use-after-free).
Fix it by leaving the HID device as-is in the worker. We can clean it up
later, either in the UHID_DESTROY command handler or in the ->release()
handler.
Cc: stable@vger.kernel.org
Fixes: 67f8ecc550b5 ("HID: uhid: fix timeout when probe races with IO")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/uhid.c | 29 +++++++++++++++++++++++++----
1 file changed, 25 insertions(+), 4 deletions(-)
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -28,11 +28,22 @@
struct uhid_device {
struct mutex devlock;
+
+ /* This flag tracks whether the HID device is usable for commands from
+ * userspace. The flag is already set before hid_add_device(), which
+ * runs in workqueue context, to allow hid_add_device() to communicate
+ * with userspace.
+ * However, if hid_add_device() fails, the flag is cleared without
+ * holding devlock.
+ * We guarantee that if @running changes from true to false while you're
+ * holding @devlock, it's still fine to access @hid.
+ */
bool running;
__u8 *rd_data;
uint rd_size;
+ /* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */
struct hid_device *hid;
struct uhid_event input_buf;
@@ -63,9 +74,18 @@ static void uhid_device_add_worker(struc
if (ret) {
hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
- hid_destroy_device(uhid->hid);
- uhid->hid = NULL;
+ /* We used to call hid_destroy_device() here, but that's really
+ * messy to get right because we have to coordinate with
+ * concurrent writes from userspace that might be in the middle
+ * of using uhid->hid.
+ * Just leave uhid->hid as-is for now, and clean it up when
+ * userspace tries to close or reinitialize the uhid instance.
+ *
+ * However, we do have to clear the ->running flag and do a
+ * wakeup to make sure userspace knows that the device is gone.
+ */
uhid->running = false;
+ wake_up_interruptible(&uhid->report_wait);
}
}
@@ -474,7 +494,7 @@ static int uhid_dev_create2(struct uhid_
void *rd_data;
int ret;
- if (uhid->running)
+ if (uhid->hid)
return -EALREADY;
rd_size = ev->u.create2.rd_size;
@@ -556,7 +576,7 @@ static int uhid_dev_create(struct uhid_d
static int uhid_dev_destroy(struct uhid_device *uhid)
{
- if (!uhid->running)
+ if (!uhid->hid)
return -EINVAL;
uhid->running = false;
@@ -565,6 +585,7 @@ static int uhid_dev_destroy(struct uhid_
cancel_work_sync(&uhid->worker);
hid_destroy_device(uhid->hid);
+ uhid->hid = NULL;
kfree(uhid->rd_data);
return 0;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 005/846] HID: wacom: Reset expected and received contact counts at the same time
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 004/846] HID: uhid: Fix worker destroying device without any protection Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 006/846] HID: wacom: Ignore the confidence flag when a touch is removed Greg Kroah-Hartman
` (844 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gerecke, Ping Cheng, Jiri Kosina
From: Jason Gerecke <killertofu@gmail.com>
commit 546e41ac994cc185ef3de610ca849a294b5df3ba upstream.
These two values go hand-in-hand and must be valid for the driver to
behave correctly. We are currently lazy about updating the values and
rely on the "expected" code flow to take care of making sure they're
valid at the point they're needed. The "expected" flow changed somewhat
with commit f8b6a74719b5 ("HID: wacom: generic: Support multiple tools
per report"), however. This led to problems with the DTH-2452 due (in
part) to *all* contacts being fully processed -- even those past the
expected contact count. Specifically, the received count gets reset to
0 once all expected fingers are processed, but not the expected count.
The rest of the contacts in the report are then *also* processed since
now the driver thinks we've only processed 0 of N expected contacts.
Later commits such as 7fb0413baa7f (HID: wacom: Use "Confidence" flag to
prevent reporting invalid contacts) worked around the DTH-2452 issue by
skipping the invalid contacts at the end of the report, but this is not
a complete fix. The confidence flag cannot be relied on when a contact
is removed (see the following patch), and dealing with that condition
re-introduces the DTH-2452 issue unless we also address this contact
count laziness. By resetting expected and received counts at the same
time we ensure the driver understands that there are 0 more contacts
expected in the report. Similarly, we also make sure to reset the
received count if for some reason we're out of sync in the pre-report
phase.
Link: https://github.com/linuxwacom/input-wacom/issues/288
Fixes: f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report")
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2692,11 +2692,14 @@ static void wacom_wac_finger_pre_report(
hid_data->cc_index >= 0) {
struct hid_field *field = report->field[hid_data->cc_index];
int value = field->value[hid_data->cc_value_index];
- if (value)
+ if (value) {
hid_data->num_expected = value;
+ hid_data->num_received = 0;
+ }
}
else {
hid_data->num_expected = wacom_wac->features.touch_max;
+ hid_data->num_received = 0;
}
}
@@ -2724,6 +2727,7 @@ static void wacom_wac_finger_report(stru
input_sync(input);
wacom_wac->hid_data.num_received = 0;
+ wacom_wac->hid_data.num_expected = 0;
/* keep touch state for pen event */
wacom_wac->shared->touch_down = wacom_wac_finger_count_touches(wacom_wac);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 006/846] HID: wacom: Ignore the confidence flag when a touch is removed
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 005/846] HID: wacom: Reset expected and received contact counts at the same time Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 007/846] HID: wacom: Avoid using stale array indicies to read contact count Greg Kroah-Hartman
` (843 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gerecke, Ping Cheng, Jiri Kosina
From: Jason Gerecke <killertofu@gmail.com>
commit df03e9bd6d4806619b4cdc91a3d7695818a8e2b7 upstream.
AES hardware may internally re-classify a contact that it thought was
intentional as a palm. Intentional contacts are reported as "down" with
the confidence bit set. When this re-classification occurs, however, the
state transitions to "up" with the confidence bit cleared. This kind of
transition appears to be legal according to Microsoft docs, but we do
not handle it correctly. Because the confidence bit is clear, we don't
call `wacom_wac_finger_slot` and update userspace. This causes hung
touches that confuse userspace and interfere with pen arbitration.
This commit adds a special case to ignore the confidence flag if a contact
is reported as removed. This ensures we do not leave a hung touch if one
of these re-classification events occured. Ideally we'd have some way to
also let userspace know that the touch has been re-classified as a palm
and needs to be canceled, but that's not possible right now :)
Link: https://github.com/linuxwacom/input-wacom/issues/288
Fixes: 7fb0413baa7f (HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 29 ++++++++++++++++++++++++++---
1 file changed, 26 insertions(+), 3 deletions(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2588,6 +2588,24 @@ static void wacom_wac_finger_slot(struct
}
}
+static bool wacom_wac_slot_is_active(struct input_dev *dev, int key)
+{
+ struct input_mt *mt = dev->mt;
+ struct input_mt_slot *s;
+
+ if (!mt)
+ return false;
+
+ for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+ if (s->key == key &&
+ input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) {
+ return true;
+ }
+ }
+
+ return false;
+}
+
static void wacom_wac_finger_event(struct hid_device *hdev,
struct hid_field *field, struct hid_usage *usage, __s32 value)
{
@@ -2638,9 +2656,14 @@ static void wacom_wac_finger_event(struc
}
if (usage->usage_index + 1 == field->report_count) {
- if (equivalent_usage == wacom_wac->hid_data.last_slot_field &&
- wacom_wac->hid_data.confidence)
- wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
+ if (equivalent_usage == wacom_wac->hid_data.last_slot_field) {
+ bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input,
+ wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch;
+
+ if (wacom_wac->hid_data.confidence || touch_removed) {
+ wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
+ }
+ }
}
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 007/846] HID: wacom: Avoid using stale array indicies to read contact count
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 006/846] HID: wacom: Ignore the confidence flag when a touch is removed Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 008/846] ALSA: core: Fix SSID quirk lookup for subvendor=0 Greg Kroah-Hartman
` (842 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gerecke, Ping Cheng, Jiri Kosina
From: Jason Gerecke <killertofu@gmail.com>
commit 20f3cf5f860f9f267a6a6e5642d3d0525edb1814 upstream.
If we ever see a touch report with contact count data we initialize
several variables used to read the contact count in the pre-report
phase. These variables are never reset if we process a report which
doesn't contain a contact count, however. This can cause the pre-
report function to trigger a read of arbitrary memory (e.g. NULL
if we're lucky) and potentially crash the driver.
This commit restores resetting of the variables back to default
"none" values that were used prior to the commit mentioned
below.
Link: https://github.com/linuxwacom/input-wacom/issues/276
Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report phase)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2682,6 +2682,10 @@ static void wacom_wac_finger_pre_report(
hid_data->confidence = true;
+ hid_data->cc_report = 0;
+ hid_data->cc_index = -1;
+ hid_data->cc_value_index = -1;
+
for (i = 0; i < report->maxfield; i++) {
struct hid_field *field = report->field[i];
int j;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 008/846] ALSA: core: Fix SSID quirk lookup for subvendor=0
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 007/846] HID: wacom: Avoid using stale array indicies to read contact count Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 009/846] f2fs: fix to do sanity check on inode type during garbage collection Greg Kroah-Hartman
` (841 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 5576c4f24c56722a2d9fb9c447d896e5b312078b upstream.
Some weird devices set the codec SSID vendor ID 0, and
snd_pci_quirk_lookup_id() loop aborts at the point although it should
still try matching with the SSID device ID. This resulted in a
missing quirk for some old Macs.
Fix the loop termination condition to check both subvendor and
subdevice.
Fixes: 73355ddd8775 ("ALSA: hda: Code refactoring snd_hda_pick_fixup()")
Cc: <stable@vger.kernel.org>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215495
Link: https://lore.kernel.org/r/20220116082838.19382-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/misc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/misc.c
+++ b/sound/core/misc.c
@@ -112,7 +112,7 @@ snd_pci_quirk_lookup_id(u16 vendor, u16
{
const struct snd_pci_quirk *q;
- for (q = list; q->subvendor; q++) {
+ for (q = list; q->subvendor || q->subdevice; q++) {
if (q->subvendor != vendor)
continue;
if (!q->subdevice ||
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 009/846] f2fs: fix to do sanity check on inode type during garbage collection
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 008/846] ALSA: core: Fix SSID quirk lookup for subvendor=0 Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 010/846] f2fs: fix to do sanity check in is_alive() Greg Kroah-Hartman
` (840 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenqing Liu, Chao Yu, Jaegeuk Kim
From: Chao Yu <chao@kernel.org>
commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f upstream.
As report by Wenqing Liu in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215231
- Overview
kernel NULL pointer dereference triggered in folio_mark_dirty() when mount and operate on a crafted f2fs image
- Reproduce
tested on kernel 5.16-rc3, 5.15.X under root
1. mkdir mnt
2. mount -t f2fs tmp1.img mnt
3. touch tmp
4. cp tmp mnt
F2FS-fs (loop0): sanity_check_inode: inode (ino=49) extent info [5942, 4294180864, 4] is incorrect, run fsck to fix
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=31340049, run fsck to fix.
BUG: kernel NULL pointer dereference, address: 0000000000000000
folio_mark_dirty+0x33/0x50
move_data_page+0x2dd/0x460 [f2fs]
do_garbage_collect+0xc18/0x16a0 [f2fs]
f2fs_gc+0x1d3/0xd90 [f2fs]
f2fs_balance_fs+0x13a/0x570 [f2fs]
f2fs_create+0x285/0x840 [f2fs]
path_openat+0xe6d/0x1040
do_filp_open+0xc5/0x140
do_sys_openat2+0x23a/0x310
do_sys_open+0x57/0x80
The root cause is for special file: e.g. character, block, fifo or socket file,
f2fs doesn't assign address space operations pointer array for mapping->a_ops field,
so, in a fuzzed image, SSA table indicates a data block belong to special file, when
f2fs tries to migrate that block, it causes NULL pointer access once move_data_page()
calls a_ops->set_dirty_page().
Cc: stable@vger.kernel.org
Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/gc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1454,7 +1454,8 @@ next_step:
if (phase == 3) {
inode = f2fs_iget(sb, dni.ino);
- if (IS_ERR(inode) || is_bad_inode(inode))
+ if (IS_ERR(inode) || is_bad_inode(inode) ||
+ special_file(inode->i_mode))
continue;
if (!down_write_trylock(
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 010/846] f2fs: fix to do sanity check in is_alive()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 009/846] f2fs: fix to do sanity check on inode type during garbage collection Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 011/846] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file Greg Kroah-Hartman
` (839 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim
From: Chao Yu <chao@kernel.org>
commit 77900c45ee5cd5da63bd4d818a41dbdf367e81cd upstream.
In fuzzed image, SSA table may indicate that a data block belongs to
invalid node, which node ID is out-of-range (0, 1, 2 or max_nid), in
order to avoid migrating inconsistent data in such corrupted image,
let's do sanity check anyway before data block migration.
Cc: stable@vger.kernel.org
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/gc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1023,6 +1023,9 @@ static bool is_alive(struct f2fs_sb_info
set_sbi_flag(sbi, SBI_NEED_FSCK);
}
+ if (f2fs_check_nid_range(sbi, dni->ino))
+ return false;
+
*nofs = ofs_of_node(node_page);
source_blkaddr = data_blkaddr(NULL, node_page, ofs_in_node);
f2fs_put_page(node_page, 1);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 011/846] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 010/846] f2fs: fix to do sanity check in is_alive() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 012/846] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() Greg Kroah-Hartman
` (838 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jaegeuk Kim
From: Jaegeuk Kim <jaegeuk@kernel.org>
commit 19bdba5265624ba6b9d9dd936a0c6ccc167cfe80 upstream.
Android OTA failed due to SBI_NEED_FSCK flag when pinning the file. Let's avoid
it since we can do in-place-updates.
Cc: stable@vger.kernel.org
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 7 +++++--
fs/f2fs/file.c | 10 +++++-----
2 files changed, 10 insertions(+), 7 deletions(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2564,6 +2564,11 @@ bool f2fs_should_update_outplace(struct
{
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ /* The below cases were checked when setting it. */
+ if (f2fs_is_pinned_file(inode))
+ return false;
+ if (fio && is_sbi_flag_set(sbi, SBI_NEED_FSCK))
+ return true;
if (f2fs_lfs_mode(sbi))
return true;
if (S_ISDIR(inode->i_mode))
@@ -2572,8 +2577,6 @@ bool f2fs_should_update_outplace(struct
return true;
if (f2fs_is_atomic_file(inode))
return true;
- if (is_sbi_flag_set(sbi, SBI_NEED_FSCK))
- return true;
/* swap file is migrating in aligned write mode */
if (is_inode_flag_set(inode, FI_ALIGNED_WRITE))
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3143,17 +3143,17 @@ static int f2fs_ioc_set_pin_file(struct
inode_lock(inode);
- if (f2fs_should_update_outplace(inode, NULL)) {
- ret = -EINVAL;
- goto out;
- }
-
if (!pin) {
clear_inode_flag(inode, FI_PIN_FILE);
f2fs_i_gc_failures_write(inode, 0);
goto done;
}
+ if (f2fs_should_update_outplace(inode, NULL)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
if (f2fs_pin_file_control(inode, false)) {
ret = -EAGAIN;
goto out;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 012/846] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 011/846] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 013/846] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings Greg Kroah-Hartman
` (837 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, David S. Miller,
syzbot+7f23bcddf626e0593a39
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
commit dded08927ca3c31a5c37f8e7f95fe98770475dd4 upstream.
Syzbot detected a NULL pointer dereference of nfc_llcp_sock->dev pointer
(which is a 'struct nfc_dev *') with calls to llcp_sock_sendmsg() after
a failed llcp_sock_bind(). The message being sent is a SOCK_DGRAM.
KASAN report:
BUG: KASAN: null-ptr-deref in nfc_alloc_send_skb+0x2d/0xc0
Read of size 4 at addr 00000000000005c8 by task llcp_sock_nfc_a/899
CPU: 5 PID: 899 Comm: llcp_sock_nfc_a Not tainted 5.16.0-rc6-next-20211224-00001-gc6437fbf18b0 #125
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x45/0x59
? nfc_alloc_send_skb+0x2d/0xc0
__kasan_report.cold+0x117/0x11c
? mark_lock+0x480/0x4f0
? nfc_alloc_send_skb+0x2d/0xc0
kasan_report+0x38/0x50
nfc_alloc_send_skb+0x2d/0xc0
nfc_llcp_send_ui_frame+0x18c/0x2a0
? nfc_llcp_send_i_frame+0x230/0x230
? __local_bh_enable_ip+0x86/0xe0
? llcp_sock_connect+0x470/0x470
? llcp_sock_connect+0x470/0x470
sock_sendmsg+0x8e/0xa0
____sys_sendmsg+0x253/0x3f0
...
The issue was visible only with multiple simultaneous calls to bind() and
sendmsg(), which resulted in most of the bind() calls to fail. The
bind() was failing on checking if there is available WKS/SDP/SAP
(respective bit in 'struct nfc_llcp_local' fields). When there was no
available WKS/SDP/SAP, the bind returned error but the sendmsg() to such
socket was able to trigger mentioned NULL pointer dereference of
nfc_llcp_sock->dev.
The code looks simply racy and currently it protects several paths
against race with checks for (!nfc_llcp_sock->local) which is NULL-ified
in error paths of bind(). The llcp_sock_sendmsg() did not have such
check but called function nfc_llcp_send_ui_frame() had, although not
protected with lock_sock().
Therefore the race could look like (same socket is used all the time):
CPU0 CPU1
==== ====
llcp_sock_bind()
- lock_sock()
- success
- release_sock()
- return 0
llcp_sock_sendmsg()
- lock_sock()
- release_sock()
llcp_sock_bind(), same socket
- lock_sock()
- error
- nfc_llcp_send_ui_frame()
- if (!llcp_sock->local)
- llcp_sock->local = NULL
- nfc_put_device(dev)
- dereference llcp_sock->dev
- release_sock()
- return -ERRNO
The nfc_llcp_send_ui_frame() checked llcp_sock->local outside of the
lock, which is racy and ineffective check. Instead, its caller
llcp_sock_sendmsg(), should perform the check inside lock_sock().
Reported-and-tested-by: syzbot+7f23bcddf626e0593a39@syzkaller.appspotmail.com
Fixes: b874dec21d1c ("NFC: Implement LLCP connection less Tx path")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/llcp_sock.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -789,6 +789,11 @@ static int llcp_sock_sendmsg(struct sock
lock_sock(sk);
+ if (!llcp_sock->local) {
+ release_sock(sk);
+ return -ENODEV;
+ }
+
if (sk->sk_type == SOCK_DGRAM) {
DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr,
msg->msg_name);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 013/846] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 012/846] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 014/846] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 Greg Kroah-Hartman
` (836 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Riedmueller, Christian Eggers,
Han Xu, Miquel Raynal
From: Christian Eggers <ceggers@arri.de>
commit f53d4c109a666bf1a4883b45d546fba079258717 upstream.
gpmi_io clock needs to be gated off when changing the parent/dividers of
enfc_clk_root (i.MX6Q/i.MX6UL) respectively qspi2_clk_root (i.MX6SX).
Otherwise this rate change can lead to an unresponsive GPMI core which
results in DMA timeouts and failed driver probe:
[ 4.072318] gpmi-nand 112000.gpmi-nand: DMA timeout, last DMA
...
[ 4.370355] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -110
...
[ 4.375988] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22
[ 4.381524] gpmi-nand 112000.gpmi-nand: Error in ECC-based read: -22
[ 4.387988] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22
[ 4.393535] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22
...
Other than stated in i.MX 6 erratum ERR007117, it should be sufficient
to gate only gpmi_io because all other bch/nand clocks are derived from
different clock roots.
The i.MX6 reference manuals state that changing clock muxers can cause
glitches but are silent about changing dividers. But tests showed that
these glitches can definitely happen on i.MX6ULL. For i.MX7D/8MM in turn,
the manual guarantees that no glitches can happen when changing
dividers.
Co-developed-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Signed-off-by: Christian Eggers <ceggers@arri.de>
Cc: stable@vger.kernel.org
Acked-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211102202022.15551-2-ceggers@arri.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 28 +++++++++++++++++++++++++---
1 file changed, 25 insertions(+), 3 deletions(-)
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -713,14 +713,32 @@ static void gpmi_nfc_compute_timings(str
(use_half_period ? BM_GPMI_CTRL1_HALF_PERIOD : 0);
}
-static void gpmi_nfc_apply_timings(struct gpmi_nand_data *this)
+static int gpmi_nfc_apply_timings(struct gpmi_nand_data *this)
{
struct gpmi_nfc_hardware_timing *hw = &this->hw;
struct resources *r = &this->resources;
void __iomem *gpmi_regs = r->gpmi_regs;
unsigned int dll_wait_time_us;
+ int ret;
+
+ /* Clock dividers do NOT guarantee a clean clock signal on its output
+ * during the change of the divide factor on i.MX6Q/UL/SX. On i.MX7/8,
+ * all clock dividers provide these guarantee.
+ */
+ if (GPMI_IS_MX6Q(this) || GPMI_IS_MX6SX(this))
+ clk_disable_unprepare(r->clock[0]);
+
+ ret = clk_set_rate(r->clock[0], hw->clk_rate);
+ if (ret) {
+ dev_err(this->dev, "cannot set clock rate to %lu Hz: %d\n", hw->clk_rate, ret);
+ return ret;
+ }
- clk_set_rate(r->clock[0], hw->clk_rate);
+ if (GPMI_IS_MX6Q(this) || GPMI_IS_MX6SX(this)) {
+ ret = clk_prepare_enable(r->clock[0]);
+ if (ret)
+ return ret;
+ }
writel(hw->timing0, gpmi_regs + HW_GPMI_TIMING0);
writel(hw->timing1, gpmi_regs + HW_GPMI_TIMING1);
@@ -739,6 +757,8 @@ static void gpmi_nfc_apply_timings(struc
/* Wait for the DLL to settle. */
udelay(dll_wait_time_us);
+
+ return 0;
}
static int gpmi_setup_interface(struct nand_chip *chip, int chipnr,
@@ -2280,7 +2300,9 @@ static int gpmi_nfc_exec_op(struct nand_
*/
if (this->hw.must_apply_timings) {
this->hw.must_apply_timings = false;
- gpmi_nfc_apply_timings(this);
+ ret = gpmi_nfc_apply_timings(this);
+ if (ret)
+ return ret;
}
dev_dbg(this->dev, "%s: %d instructions\n", __func__, op->ninstrs);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 014/846] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 013/846] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 015/846] mtd: Fixed breaking list in __mtd_del_partition Greg Kroah-Hartman
` (835 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Riedmueller, Han Xu, Miquel Raynal
From: Stefan Riedmueller <s.riedmueller@phytec.de>
commit aa1baa0e6c1aa4872e481dce4fc7fd6f3dd8496b upstream.
There is no need to explicitly set the default gpmi clock rate during
boot for the i.MX 6 since this is done during nand_detect anyway.
Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Cc: stable@vger.kernel.org
Acked-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211102202022.15551-1-ceggers@arri.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 9 ---------
1 file changed, 9 deletions(-)
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -1054,15 +1054,6 @@ static int gpmi_get_clks(struct gpmi_nan
r->clock[i] = clk;
}
- if (GPMI_IS_MX6(this))
- /*
- * Set the default value for the gpmi clock.
- *
- * If you want to use the ONFI nand which is in the
- * Synchronous Mode, you should change the clock as you need.
- */
- clk_set_rate(r->clock[0], 22000000);
-
return 0;
err_clock:
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 015/846] mtd: Fixed breaking list in __mtd_del_partition.
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 014/846] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 016/846] mtd: rawnand: davinci: Dont calculate ECC when reading page Greg Kroah-Hartman
` (834 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andreas Oetken, Miquel Raynal
From: Andreas Oetken <ennoerlangen@gmail.com>
commit 2966daf7d253d9904b337b040dd7a43472858b8a upstream.
Not the child partition should be removed from the partition list
but the partition itself. Otherwise the partition list gets broken
and any subsequent remove operations leads to a kernel panic.
Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling")
Signed-off-by: Andreas Oetken <andreas.oetken@siemens-energy.com>
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211102172604.2921065-1-andreas.oetken@siemens-energy.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/mtdpart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -312,7 +312,7 @@ static int __mtd_del_partition(struct mt
if (err)
return err;
- list_del(&child->part.node);
+ list_del(&mtd->part.node);
free_partition(mtd);
return 0;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 016/846] mtd: rawnand: davinci: Dont calculate ECC when reading page
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 015/846] mtd: Fixed breaking list in __mtd_del_partition Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 017/846] mtd: rawnand: davinci: Avoid duplicated page read Greg Kroah-Hartman
` (833 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit 71e89591502d737c10db2bd4d8fcfaa352552afb upstream.
The function nand_davinci_read_page_hwecc_oob_first() does read the ECC
data from the OOB area. Therefore it does not need to calculate the ECC
as it is already available.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-1-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/davinci_nand.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/mtd/nand/raw/davinci_nand.c
+++ b/drivers/mtd/nand/raw/davinci_nand.c
@@ -394,7 +394,6 @@ static int nand_davinci_read_page_hwecc_
int eccsteps = chip->ecc.steps;
uint8_t *p = buf;
uint8_t *ecc_code = chip->ecc.code_buf;
- uint8_t *ecc_calc = chip->ecc.calc_buf;
unsigned int max_bitflips = 0;
/* Read the OOB area first */
@@ -420,8 +419,6 @@ static int nand_davinci_read_page_hwecc_
if (ret)
return ret;
- chip->ecc.calculate(chip, p, &ecc_calc[i]);
-
stat = chip->ecc.correct(chip, p, &ecc_code[i], NULL);
if (stat == -EBADMSG &&
(chip->ecc.options & NAND_ECC_GENERIC_ERASED_CHECK)) {
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 017/846] mtd: rawnand: davinci: Avoid duplicated page read
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 016/846] mtd: rawnand: davinci: Dont calculate ECC when reading page Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 018/846] mtd: rawnand: davinci: Rewrite function description Greg Kroah-Hartman
` (832 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit 9c9d709965385de5a99f84b14bd5860e1541729e upstream.
The function nand_davinci_read_page_hwecc_oob_first() first reads the
OOB data, extracts the ECC information, programs the ECC hardware before
reading the actual data in a loop.
Right after the OOB data was read, it called nand_read_page_op() to
reset the read cursor to the beginning of the page. This caused the
first page to be read twice: in that call, and later in the loop.
Address that issue by changing the call to nand_read_page_op() to
nand_change_read_column_op(), which will only reset the read cursor.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-2-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/davinci_nand.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/davinci_nand.c
+++ b/drivers/mtd/nand/raw/davinci_nand.c
@@ -401,7 +401,8 @@ static int nand_davinci_read_page_hwecc_
if (ret)
return ret;
- ret = nand_read_page_op(chip, page, 0, NULL, 0);
+ /* Move read cursor to start of page */
+ ret = nand_change_read_column_op(chip, 0, NULL, 0, false);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 018/846] mtd: rawnand: davinci: Rewrite function description
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 017/846] mtd: rawnand: davinci: Avoid duplicated page read Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 019/846] mtd: rawnand: Export nand_read_page_hwecc_oob_first() Greg Kroah-Hartman
` (831 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit 0697f8441faad552fbeb02d74454b5e7bcc956a2 upstream.
The original comment that describes the function
nand_davinci_read_page_hwecc_oob_first() is very obscure and it is hard
to understand what it is for.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-3-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/davinci_nand.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/drivers/mtd/nand/raw/davinci_nand.c
+++ b/drivers/mtd/nand/raw/davinci_nand.c
@@ -372,17 +372,15 @@ correct:
}
/**
- * nand_read_page_hwecc_oob_first - hw ecc, read oob first
+ * nand_davinci_read_page_hwecc_oob_first - Hardware ECC page read with ECC
+ * data read from OOB area
* @chip: nand chip info structure
* @buf: buffer to store read data
* @oob_required: caller requires OOB data read to chip->oob_poi
* @page: page number to read
*
- * Hardware ECC for large page chips, require OOB to be read first. For this
- * ECC mode, the write_page method is re-used from ECC_HW. These methods
- * read/write ECC from the OOB area, unlike the ECC_HW_SYNDROME support with
- * multiple ECC steps, follows the "infix ECC" scheme and reads/writes ECC from
- * the data area, by overwriting the NAND manufacturer bad block markings.
+ * Hardware ECC for large page chips, which requires the ECC data to be
+ * extracted from the OOB before the actual data is read.
*/
static int nand_davinci_read_page_hwecc_oob_first(struct nand_chip *chip,
uint8_t *buf,
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 019/846] mtd: rawnand: Export nand_read_page_hwecc_oob_first()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 018/846] mtd: rawnand: davinci: Rewrite function description Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 020/846] mtd: rawnand: ingenic: JZ4740 needs oob_first read page function Greg Kroah-Hartman
` (830 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit d8466f73010faf71effb21228ae1cbf577dab130 upstream.
Move the function nand_read_page_hwecc_oob_first() (previously
nand_davinci_read_page_hwecc_oob_first()) to nand_base.c, and export it
as a GPL symbol, so that it can be used by more modules.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-4-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/davinci_nand.c | 69 ------------------------------------
drivers/mtd/nand/raw/nand_base.c | 67 ++++++++++++++++++++++++++++++++++
include/linux/mtd/rawnand.h | 2 +
3 files changed, 70 insertions(+), 68 deletions(-)
--- a/drivers/mtd/nand/raw/davinci_nand.c
+++ b/drivers/mtd/nand/raw/davinci_nand.c
@@ -371,73 +371,6 @@ correct:
return corrected;
}
-/**
- * nand_davinci_read_page_hwecc_oob_first - Hardware ECC page read with ECC
- * data read from OOB area
- * @chip: nand chip info structure
- * @buf: buffer to store read data
- * @oob_required: caller requires OOB data read to chip->oob_poi
- * @page: page number to read
- *
- * Hardware ECC for large page chips, which requires the ECC data to be
- * extracted from the OOB before the actual data is read.
- */
-static int nand_davinci_read_page_hwecc_oob_first(struct nand_chip *chip,
- uint8_t *buf,
- int oob_required, int page)
-{
- struct mtd_info *mtd = nand_to_mtd(chip);
- int i, eccsize = chip->ecc.size, ret;
- int eccbytes = chip->ecc.bytes;
- int eccsteps = chip->ecc.steps;
- uint8_t *p = buf;
- uint8_t *ecc_code = chip->ecc.code_buf;
- unsigned int max_bitflips = 0;
-
- /* Read the OOB area first */
- ret = nand_read_oob_op(chip, page, 0, chip->oob_poi, mtd->oobsize);
- if (ret)
- return ret;
-
- /* Move read cursor to start of page */
- ret = nand_change_read_column_op(chip, 0, NULL, 0, false);
- if (ret)
- return ret;
-
- ret = mtd_ooblayout_get_eccbytes(mtd, ecc_code, chip->oob_poi, 0,
- chip->ecc.total);
- if (ret)
- return ret;
-
- for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
- int stat;
-
- chip->ecc.hwctl(chip, NAND_ECC_READ);
-
- ret = nand_read_data_op(chip, p, eccsize, false, false);
- if (ret)
- return ret;
-
- stat = chip->ecc.correct(chip, p, &ecc_code[i], NULL);
- if (stat == -EBADMSG &&
- (chip->ecc.options & NAND_ECC_GENERIC_ERASED_CHECK)) {
- /* check for empty pages with bitflips */
- stat = nand_check_erased_ecc_chunk(p, eccsize,
- &ecc_code[i],
- eccbytes, NULL, 0,
- chip->ecc.strength);
- }
-
- if (stat < 0) {
- mtd->ecc_stats.failed++;
- } else {
- mtd->ecc_stats.corrected += stat;
- max_bitflips = max_t(unsigned int, max_bitflips, stat);
- }
- }
- return max_bitflips;
-}
-
/*----------------------------------------------------------------------*/
/* An ECC layout for using 4-bit ECC with small-page flash, storing
@@ -647,7 +580,7 @@ static int davinci_nand_attach_chip(stru
} else if (chunks == 4 || chunks == 8) {
mtd_set_ooblayout(mtd,
nand_get_large_page_ooblayout());
- chip->ecc.read_page = nand_davinci_read_page_hwecc_oob_first;
+ chip->ecc.read_page = nand_read_page_hwecc_oob_first;
} else {
return -EIO;
}
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -3161,6 +3161,73 @@ static int nand_read_page_hwecc(struct n
}
/**
+ * nand_read_page_hwecc_oob_first - Hardware ECC page read with ECC
+ * data read from OOB area
+ * @chip: nand chip info structure
+ * @buf: buffer to store read data
+ * @oob_required: caller requires OOB data read to chip->oob_poi
+ * @page: page number to read
+ *
+ * Hardware ECC for large page chips, which requires the ECC data to be
+ * extracted from the OOB before the actual data is read.
+ */
+int nand_read_page_hwecc_oob_first(struct nand_chip *chip, uint8_t *buf,
+ int oob_required, int page)
+{
+ struct mtd_info *mtd = nand_to_mtd(chip);
+ int i, eccsize = chip->ecc.size, ret;
+ int eccbytes = chip->ecc.bytes;
+ int eccsteps = chip->ecc.steps;
+ uint8_t *p = buf;
+ uint8_t *ecc_code = chip->ecc.code_buf;
+ unsigned int max_bitflips = 0;
+
+ /* Read the OOB area first */
+ ret = nand_read_oob_op(chip, page, 0, chip->oob_poi, mtd->oobsize);
+ if (ret)
+ return ret;
+
+ /* Move read cursor to start of page */
+ ret = nand_change_read_column_op(chip, 0, NULL, 0, false);
+ if (ret)
+ return ret;
+
+ ret = mtd_ooblayout_get_eccbytes(mtd, ecc_code, chip->oob_poi, 0,
+ chip->ecc.total);
+ if (ret)
+ return ret;
+
+ for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
+ int stat;
+
+ chip->ecc.hwctl(chip, NAND_ECC_READ);
+
+ ret = nand_read_data_op(chip, p, eccsize, false, false);
+ if (ret)
+ return ret;
+
+ stat = chip->ecc.correct(chip, p, &ecc_code[i], NULL);
+ if (stat == -EBADMSG &&
+ (chip->ecc.options & NAND_ECC_GENERIC_ERASED_CHECK)) {
+ /* check for empty pages with bitflips */
+ stat = nand_check_erased_ecc_chunk(p, eccsize,
+ &ecc_code[i],
+ eccbytes, NULL, 0,
+ chip->ecc.strength);
+ }
+
+ if (stat < 0) {
+ mtd->ecc_stats.failed++;
+ } else {
+ mtd->ecc_stats.corrected += stat;
+ max_bitflips = max_t(unsigned int, max_bitflips, stat);
+ }
+ }
+ return max_bitflips;
+}
+EXPORT_SYMBOL_GPL(nand_read_page_hwecc_oob_first);
+
+/**
* nand_read_page_syndrome - [REPLACEABLE] hardware ECC syndrome based page read
* @chip: nand chip info structure
* @buf: buffer to store read data
--- a/include/linux/mtd/rawnand.h
+++ b/include/linux/mtd/rawnand.h
@@ -1539,6 +1539,8 @@ int nand_read_data_op(struct nand_chip *
bool force_8bit, bool check_only);
int nand_write_data_op(struct nand_chip *chip, const void *buf,
unsigned int len, bool force_8bit);
+int nand_read_page_hwecc_oob_first(struct nand_chip *chip, uint8_t *buf,
+ int oob_required, int page);
/* Scan and identify a NAND device */
int nand_scan_with_ids(struct nand_chip *chip, unsigned int max_chips,
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 020/846] mtd: rawnand: ingenic: JZ4740 needs oob_first read page function
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 019/846] mtd: rawnand: Export nand_read_page_hwecc_oob_first() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 021/846] riscv: Get rid of MAXPHYSMEM configs Greg Kroah-Hartman
` (829 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit 0171480007d64f663aae9226303f1b1e4621229e upstream.
The ECC engine on the JZ4740 SoC requires the ECC data to be read before
the page; using the default page reading function does not work. Indeed,
the old JZ4740 NAND driver (removed in 5.4) did use the 'OOB first' flag
that existed back then.
Use the newly created nand_read_page_hwecc_oob_first() to address this
issue.
This issue was not found when the new ingenic-nand driver was developed,
most likely because the Device Tree used had the nand-ecc-mode set to
"hw_oob_first", which seems to not be supported anymore.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-5-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c
+++ b/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c
@@ -32,6 +32,7 @@ struct jz_soc_info {
unsigned long addr_offset;
unsigned long cmd_offset;
const struct mtd_ooblayout_ops *oob_layout;
+ bool oob_first;
};
struct ingenic_nand_cs {
@@ -240,6 +241,9 @@ static int ingenic_nand_attach_chip(stru
if (chip->bbt_options & NAND_BBT_USE_FLASH)
chip->bbt_options |= NAND_BBT_NO_OOB;
+ if (nfc->soc_info->oob_first)
+ chip->ecc.read_page = nand_read_page_hwecc_oob_first;
+
/* For legacy reasons we use a different layout on the qi,lb60 board. */
if (of_machine_is_compatible("qi,lb60"))
mtd_set_ooblayout(mtd, &qi_lb60_ooblayout_ops);
@@ -534,6 +538,7 @@ static const struct jz_soc_info jz4740_s
.data_offset = 0x00000000,
.cmd_offset = 0x00008000,
.addr_offset = 0x00010000,
+ .oob_first = true,
};
static const struct jz_soc_info jz4725b_soc_info = {
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 021/846] riscv: Get rid of MAXPHYSMEM configs
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 020/846] mtd: rawnand: ingenic: JZ4740 needs oob_first read page function Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 022/846] RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n Greg Kroah-Hartman
` (828 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Alexandre Ghiti,
Conor Dooley, Palmer Dabbelt
From: Alexandre Ghiti <alexandre.ghiti@canonical.com>
commit db1503d355a79d1d4255a9996f20e72848b74a56 upstream.
CONFIG_MAXPHYSMEM_* are actually never used, even the nommu defconfigs
selecting the MAXPHYSMEM_2GB had no effects on PAGE_OFFSET since it was
preempted by !MMU case right before.
In addition, the move of the kernel mapping at the end of the address
space broke the use of MAXPHYSMEM_2G with MMU since it defines PAGE_OFFSET
at the same address as the kernel mapping.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Fixes: 2bfc6cd81bd1 ("riscv: Move kernel mapping outside of linear mapping")
Signed-off-by: Alexandre Ghiti <alexandre.ghiti@canonical.com>
Tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Conor Dooley <Conor.Dooley@microchip.com>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/Kconfig | 23 ++---------------------
arch/riscv/configs/nommu_k210_defconfig | 2 --
arch/riscv/configs/nommu_k210_sdcard_defconfig | 2 --
arch/riscv/configs/nommu_virt_defconfig | 1 -
4 files changed, 2 insertions(+), 26 deletions(-)
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -158,10 +158,9 @@ config PA_BITS
config PAGE_OFFSET
hex
- default 0xC0000000 if 32BIT && MAXPHYSMEM_1GB
+ default 0xC0000000 if 32BIT
default 0x80000000 if 64BIT && !MMU
- default 0xffffffff80000000 if 64BIT && MAXPHYSMEM_2GB
- default 0xffffffe000000000 if 64BIT && MAXPHYSMEM_128GB
+ default 0xffffffe000000000 if 64BIT
config KASAN_SHADOW_OFFSET
hex
@@ -270,24 +269,6 @@ config MODULE_SECTIONS
bool
select HAVE_MOD_ARCH_SPECIFIC
-choice
- prompt "Maximum Physical Memory"
- default MAXPHYSMEM_1GB if 32BIT
- default MAXPHYSMEM_2GB if 64BIT && CMODEL_MEDLOW
- default MAXPHYSMEM_128GB if 64BIT && CMODEL_MEDANY
-
- config MAXPHYSMEM_1GB
- depends on 32BIT
- bool "1GiB"
- config MAXPHYSMEM_2GB
- depends on 64BIT && CMODEL_MEDLOW
- bool "2GiB"
- config MAXPHYSMEM_128GB
- depends on 64BIT && CMODEL_MEDANY
- bool "128GiB"
-endchoice
-
-
config SMP
bool "Symmetric Multi-Processing"
help
--- a/arch/riscv/configs/nommu_k210_defconfig
+++ b/arch/riscv/configs/nommu_k210_defconfig
@@ -29,8 +29,6 @@ CONFIG_EMBEDDED=y
CONFIG_SLOB=y
# CONFIG_MMU is not set
CONFIG_SOC_CANAAN=y
-CONFIG_SOC_CANAAN_K210_DTB_SOURCE="k210_generic"
-CONFIG_MAXPHYSMEM_2GB=y
CONFIG_SMP=y
CONFIG_NR_CPUS=2
CONFIG_CMDLINE="earlycon console=ttySIF0"
--- a/arch/riscv/configs/nommu_k210_sdcard_defconfig
+++ b/arch/riscv/configs/nommu_k210_sdcard_defconfig
@@ -21,8 +21,6 @@ CONFIG_EMBEDDED=y
CONFIG_SLOB=y
# CONFIG_MMU is not set
CONFIG_SOC_CANAAN=y
-CONFIG_SOC_CANAAN_K210_DTB_SOURCE="k210_generic"
-CONFIG_MAXPHYSMEM_2GB=y
CONFIG_SMP=y
CONFIG_NR_CPUS=2
CONFIG_CMDLINE="earlycon console=ttySIF0 rootdelay=2 root=/dev/mmcblk0p1 ro"
--- a/arch/riscv/configs/nommu_virt_defconfig
+++ b/arch/riscv/configs/nommu_virt_defconfig
@@ -27,7 +27,6 @@ CONFIG_SLOB=y
# CONFIG_SLAB_MERGE_DEFAULT is not set
# CONFIG_MMU is not set
CONFIG_SOC_VIRT=y
-CONFIG_MAXPHYSMEM_2GB=y
CONFIG_SMP=y
CONFIG_CMDLINE="root=/dev/vda rw earlycon=uart8250,mmio,0x10000000,115200n8 console=ttyS0"
CONFIG_CMDLINE_FORCE=y
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 022/846] RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 021/846] riscv: Get rid of MAXPHYSMEM configs Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 023/846] riscv: try to allocate crashkern region from 32bit addressible memory Greg Kroah-Hartman
` (827 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adam Borowski, Anup Patel,
Sean Christopherson, Palmer Dabbelt
From: Sean Christopherson <seanjc@google.com>
commit 869c70609248102f3a2e95a39b6233ff6ea2c932 upstream.
Use what is currently the SMP=y version of riscv_cpuid_to_hartid_mask()
for both SMP=y and SMP=n to fix a build failure with KVM=m and SMP=n due
to boot_cpu_hartid not being exported. This also fixes a second bug
where the SMP=n version assumes the sole CPU in the system is in the
incoming mask, which may not hold true in kvm_riscv_vcpu_sbi_ecall() if
the KVM guest VM has multiple vCPUs (on a SMP=n system).
Fixes: 1ef46c231df4 ("RISC-V: Implement new SBI v0.2 extensions")
Reported-by: Adam Borowski <kilobyte@angband.pl>
Reviewed-by: Anup Patel <anup.patel@wdc.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/smp.h | 10 ++--------
arch/riscv/kernel/setup.c | 10 ++++++++++
arch/riscv/kernel/smp.c | 10 ----------
3 files changed, 12 insertions(+), 18 deletions(-)
--- a/arch/riscv/include/asm/smp.h
+++ b/arch/riscv/include/asm/smp.h
@@ -43,7 +43,6 @@ void arch_send_call_function_ipi_mask(st
void arch_send_call_function_single_ipi(int cpu);
int riscv_hartid_to_cpuid(int hartid);
-void riscv_cpuid_to_hartid_mask(const struct cpumask *in, struct cpumask *out);
/* Set custom IPI operations */
void riscv_set_ipi_ops(const struct riscv_ipi_ops *ops);
@@ -85,13 +84,6 @@ static inline unsigned long cpuid_to_har
return boot_cpu_hartid;
}
-static inline void riscv_cpuid_to_hartid_mask(const struct cpumask *in,
- struct cpumask *out)
-{
- cpumask_clear(out);
- cpumask_set_cpu(boot_cpu_hartid, out);
-}
-
static inline void riscv_set_ipi_ops(const struct riscv_ipi_ops *ops)
{
}
@@ -102,6 +94,8 @@ static inline void riscv_clear_ipi(void)
#endif /* CONFIG_SMP */
+void riscv_cpuid_to_hartid_mask(const struct cpumask *in, struct cpumask *out);
+
#if defined(CONFIG_HOTPLUG_CPU) && (CONFIG_SMP)
bool cpu_has_hotplug(unsigned int cpu);
#else
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -59,6 +59,16 @@ atomic_t hart_lottery __section(".sdata"
unsigned long boot_cpu_hartid;
static DEFINE_PER_CPU(struct cpu, cpu_devices);
+void riscv_cpuid_to_hartid_mask(const struct cpumask *in, struct cpumask *out)
+{
+ int cpu;
+
+ cpumask_clear(out);
+ for_each_cpu(cpu, in)
+ cpumask_set_cpu(cpuid_to_hartid_map(cpu), out);
+}
+EXPORT_SYMBOL_GPL(riscv_cpuid_to_hartid_mask);
+
/*
* Place kernel memory regions on the resource tree so that
* kexec-tools can retrieve them from /proc/iomem. While there
--- a/arch/riscv/kernel/smp.c
+++ b/arch/riscv/kernel/smp.c
@@ -59,16 +59,6 @@ int riscv_hartid_to_cpuid(int hartid)
return -ENOENT;
}
-void riscv_cpuid_to_hartid_mask(const struct cpumask *in, struct cpumask *out)
-{
- int cpu;
-
- cpumask_clear(out);
- for_each_cpu(cpu, in)
- cpumask_set_cpu(cpuid_to_hartid_map(cpu), out);
-}
-EXPORT_SYMBOL_GPL(riscv_cpuid_to_hartid_mask);
-
bool arch_match_cpu_phys_id(int cpu, u64 phys_id)
{
return phys_id == cpuid_to_hartid_map(cpu);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 023/846] riscv: try to allocate crashkern region from 32bit addressible memory
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 022/846] RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 024/846] riscv: Dont use va_pa_offset on kdump Greg Kroah-Hartman
` (826 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nick Kossifidis, Palmer Dabbelt
From: Nick Kossifidis <mick@ics.forth.gr>
commit decf89f86ecd3c3c3de81c562010d5797bea3de1 upstream.
When allocating crash kernel region without explicitly specifying its
base address/size, memblock_phys_alloc_range will attempt to allocate
memory top to bottom (memblock.bottom_up is false), so the crash
kernel region will end up in highmem on 64bit systems. This way
swiotlb can't work on the crash kernel, since there won't be any
32bit addressible memory available for the bounce buffers.
Try to allocate 32bit addressible memory if available, for the
crash kernel by restricting the top search address to be less
than SZ_4G. If that fails fallback to the previous behavior.
I tested this on HiFive Unmatched where the pci-e controller needs
swiotlb to work, with this patch it's possible to access the pci-e
controller on crash kernel and mount the rootfs from the nvme.
Signed-off-by: Nick Kossifidis <mick@ics.forth.gr>
Fixes: e53d28180d4d ("RISC-V: Add kdump support")
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/mm/init.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -813,13 +813,22 @@ static void __init reserve_crashkernel(v
/*
* Current riscv boot protocol requires 2MB alignment for
* RV64 and 4MB alignment for RV32 (hugepage size)
+ *
+ * Try to alloc from 32bit addressible physical memory so that
+ * swiotlb can work on the crash kernel.
*/
crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
- search_start, search_end);
+ search_start,
+ min(search_end, (unsigned long) SZ_4G));
if (crash_base == 0) {
- pr_warn("crashkernel: couldn't allocate %lldKB\n",
- crash_size >> 10);
- return;
+ /* Try again without restricting region to 32bit addressible memory */
+ crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
+ search_start, search_end);
+ if (crash_base == 0) {
+ pr_warn("crashkernel: couldn't allocate %lldKB\n",
+ crash_size >> 10);
+ return;
+ }
}
pr_info("crashkernel: reserved 0x%016llx - 0x%016llx (%lld MB)\n",
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 024/846] riscv: Dont use va_pa_offset on kdump
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 023/846] riscv: try to allocate crashkern region from 32bit addressible memory Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 025/846] riscv: use hart id instead of cpu id on machine_kexec Greg Kroah-Hartman
` (825 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nick Kossifidis, Alexandre Ghiti,
Palmer Dabbelt
From: Nick Kossifidis <mick@ics.forth.gr>
commit a11c07f032a0e9a562a32ece73af96b0e754c4b3 upstream.
On kdump instead of using an intermediate step to relocate the kernel,
that lives in a "control buffer" outside the current kernel's mapping,
we jump to the crash kernel directly by calling riscv_kexec_norelocate().
The current implementation uses va_pa_offset while switching to physical
addressing, however since we moved the kernel outside the linear mapping
this won't work anymore since riscv_kexec_norelocate() is part of the
kernel mapping and we should use kernel_map.va_kernel_pa_offset, and also
take XIP kernel into account.
We don't really need to use va_pa_offset on riscv_kexec_norelocate, we
can just set STVEC to the physical address of the new kernel instead and
let the hart jump to the new kernel on the next instruction after setting
SATP to zero. This fixes kdump and is also simpler/cleaner.
I tested this on the latest qemu and HiFive Unmatched and works as
expected.
Fixes: 2bfc6cd81bd1 ("riscv: Move kernel mapping outside of linear mapping")
Signed-off-by: Nick Kossifidis <mick@ics.forth.gr>
Reviewed-by: Alexandre Ghiti <alex@ghiti.fr>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/kexec_relocate.S | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
--- a/arch/riscv/kernel/kexec_relocate.S
+++ b/arch/riscv/kernel/kexec_relocate.S
@@ -159,25 +159,15 @@ SYM_CODE_START(riscv_kexec_norelocate)
* s0: (const) Phys address to jump to
* s1: (const) Phys address of the FDT image
* s2: (const) The hartid of the current hart
- * s3: (const) kernel_map.va_pa_offset, used when switching MMU off
*/
mv s0, a1
mv s1, a2
mv s2, a3
- mv s3, a4
/* Disable / cleanup interrupts */
csrw CSR_SIE, zero
csrw CSR_SIP, zero
- /* Switch to physical addressing */
- la s4, 1f
- sub s4, s4, s3
- csrw CSR_STVEC, s4
- csrw CSR_SATP, zero
-
-.align 2
-1:
/* Pass the arguments to the next kernel / Cleanup*/
mv a0, s2
mv a1, s1
@@ -214,7 +204,15 @@ SYM_CODE_START(riscv_kexec_norelocate)
csrw CSR_SCAUSE, zero
csrw CSR_SSCRATCH, zero
- jalr zero, a2, 0
+ /*
+ * Switch to physical addressing
+ * This will also trigger a jump to CSR_STVEC
+ * which in this case is the address of the new
+ * kernel.
+ */
+ csrw CSR_STVEC, a2
+ csrw CSR_SATP, zero
+
SYM_CODE_END(riscv_kexec_norelocate)
.section ".rodata"
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 025/846] riscv: use hart id instead of cpu id on machine_kexec
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 024/846] riscv: Dont use va_pa_offset on kdump Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 026/846] riscv: mm: fix wrong phys_ram_base value for RV64 Greg Kroah-Hartman
` (824 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nick Kossifidis, Palmer Dabbelt
From: Nick Kossifidis <mick@ics.forth.gr>
commit 0e105f1d0037d677dff3c697d22f9551e6c39af8 upstream.
raw_smp_processor_id() doesn't return the hart id as stated in
arch/riscv/include/asm/smp.h, use smp_processor_id() instead
to get the cpu id, and cpuid_to_hartid_map() to pass the hart id
to the next kernel. This fixes kexec on HiFive Unleashed/Unmatched
where cpu ids and hart ids don't match (on qemu-virt they match).
Fixes: fba8a8674f68 ("RISC-V: Add kexec support")
Signed-off-by: Nick Kossifidis <mick@ics.forth.gr>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/machine_kexec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/riscv/kernel/machine_kexec.c
+++ b/arch/riscv/kernel/machine_kexec.c
@@ -169,7 +169,8 @@ machine_kexec(struct kimage *image)
struct kimage_arch *internal = &image->arch;
unsigned long jump_addr = (unsigned long) image->start;
unsigned long first_ind_entry = (unsigned long) &image->head;
- unsigned long this_hart_id = raw_smp_processor_id();
+ unsigned long this_cpu_id = smp_processor_id();
+ unsigned long this_hart_id = cpuid_to_hartid_map(this_cpu_id);
unsigned long fdt_addr = internal->fdt_addr;
void *control_code_buffer = page_address(image->control_code_page);
riscv_kexec_method kexec_method = NULL;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 026/846] riscv: mm: fix wrong phys_ram_base value for RV64
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 025/846] riscv: use hart id instead of cpu id on machine_kexec Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 027/846] x86/gpu: Reserve stolen memory for first integrated Intel GPU Greg Kroah-Hartman
` (823 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jisheng Zhang, Alexandre Ghiti,
Palmer Dabbelt
From: Jisheng Zhang <jszhang@kernel.org>
commit b0fd4b1bf995172b9efcee23600d4f69571c321c upstream.
Currently, if 64BIT and !XIP_KERNEL, the phys_ram_base is always 0,
no matter the real start of dram reported by memblock is.
Fixes: 6d7f91d914bc ("riscv: Get rid of CONFIG_PHYS_RAM_BASE in kernel physical address conversion")
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Reviewed-by: Alexandre Ghiti <alex@ghiti.fr>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/mm/init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -187,10 +187,10 @@ static void __init setup_bootmem(void)
phys_ram_end = memblock_end_of_DRAM();
-#ifndef CONFIG_64BIT
#ifndef CONFIG_XIP_KERNEL
phys_ram_base = memblock_start_of_DRAM();
#endif
+#ifndef CONFIG_64BIT
/*
* memblock allocator is not aware of the fact that last 4K bytes of
* the addressable memory can not be mapped because of IS_ERR_VALUE
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 027/846] x86/gpu: Reserve stolen memory for first integrated Intel GPU
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 026/846] riscv: mm: fix wrong phys_ram_base value for RV64 Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 028/846] tools/nolibc: x86-64: Fix startup code bug Greg Kroah-Hartman
` (822 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lucas De Marchi, Bjorn Helgaas
From: Lucas De Marchi <lucas.demarchi@intel.com>
commit 9c494ca4d3a535f9ca11ad6af1813983c1c6cbdd upstream.
"Stolen memory" is memory set aside for use by an Intel integrated GPU.
The intel_graphics_quirks() early quirk reserves this memory when it is
called for a GPU that appears in the intel_early_ids[] table of integrated
GPUs.
Previously intel_graphics_quirks() was marked as QFLAG_APPLY_ONCE, so it
was called only for the first Intel GPU found. If a discrete GPU happened
to be enumerated first, intel_graphics_quirks() was called for it but not
for any integrated GPU found later. Therefore, stolen memory for such an
integrated GPU was never reserved.
For example, this problem occurs in this Alderlake-P (integrated) + DG2
(discrete) topology where the DG2 is found first, but stolen memory is
associated with the integrated GPU:
- 00:01.0 Bridge
`- 03:00.0 DG2 discrete GPU
- 00:02.0 Integrated GPU (with stolen memory)
Remove the QFLAG_APPLY_ONCE flag and call intel_graphics_quirks() for every
Intel GPU. Reserve stolen memory for the first GPU that appears in
intel_early_ids[].
[bhelgaas: commit log, add code comment, squash in
https://lore.kernel.org/r/20220118190558.2ququ4vdfjuahicm@ldmartin-desk2]
Link: https://lore.kernel.org/r/20220114002843.2083382-1-lucas.demarchi@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/early-quirks.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -515,6 +515,7 @@ static const struct intel_early_ops gen1
.stolen_size = gen9_stolen_size,
};
+/* Intel integrated GPUs for which we need to reserve "stolen memory" */
static const struct pci_device_id intel_early_ids[] __initconst = {
INTEL_I830_IDS(&i830_early_ops),
INTEL_I845G_IDS(&i845_early_ops),
@@ -591,6 +592,13 @@ static void __init intel_graphics_quirks
u16 device;
int i;
+ /*
+ * Reserve "stolen memory" for an integrated GPU. If we've already
+ * found one, there's nothing to do for other (discrete) GPUs.
+ */
+ if (resource_size(&intel_graphics_stolen_res))
+ return;
+
device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
for (i = 0; i < ARRAY_SIZE(intel_early_ids); i++) {
@@ -703,7 +711,7 @@ static struct chipset early_qrk[] __init
{ PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
{ PCI_VENDOR_ID_INTEL, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA, PCI_ANY_ID,
- QFLAG_APPLY_ONCE, intel_graphics_quirks },
+ 0, intel_graphics_quirks },
/*
* HPET on the current version of the Baytrail platform has accuracy
* problems: it will halt in deep idle state - so we disable it.
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 028/846] tools/nolibc: x86-64: Fix startup code bug
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 027/846] x86/gpu: Reserve stolen memory for first integrated Intel GPU Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 029/846] crypto: x86/aesni - dont require alignment of data Greg Kroah-Hartman
` (821 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bedirhan KURT, Louvian Lyndal,
Peter Cordes, Ammar Faizi, Willy Tarreau, Paul E. McKenney
From: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
commit 937ed91c712273131de6d2a02caafd3ee84e0c72 upstream.
Before this patch, the `_start` function looks like this:
```
0000000000001170 <_start>:
1170: pop %rdi
1171: mov %rsp,%rsi
1174: lea 0x8(%rsi,%rdi,8),%rdx
1179: and $0xfffffffffffffff0,%rsp
117d: sub $0x8,%rsp
1181: call 1000 <main>
1186: movzbq %al,%rdi
118a: mov $0x3c,%rax
1191: syscall
1193: hlt
1194: data16 cs nopw 0x0(%rax,%rax,1)
119f: nop
```
Note the "and" to %rsp with $-16, it makes the %rsp be 16-byte aligned,
but then there is a "sub" with $0x8 which makes the %rsp no longer
16-byte aligned, then it calls main. That's the bug!
What actually the x86-64 System V ABI mandates is that right before the
"call", the %rsp must be 16-byte aligned, not after the "call". So the
"sub" with $0x8 here breaks the alignment. Remove it.
An example where this rule matters is when the callee needs to align
its stack at 16-byte for aligned move instruction, like `movdqa` and
`movaps`. If the callee can't align its stack properly, it will result
in segmentation fault.
x86-64 System V ABI also mandates the deepest stack frame should be
zero. Just to be safe, let's zero the %rbp on startup as the content
of %rbp may be unspecified when the program starts. Now it looks like
this:
```
0000000000001170 <_start>:
1170: pop %rdi
1171: mov %rsp,%rsi
1174: lea 0x8(%rsi,%rdi,8),%rdx
1179: xor %ebp,%ebp # zero the %rbp
117b: and $0xfffffffffffffff0,%rsp # align the %rsp
117f: call 1000 <main>
1184: movzbq %al,%rdi
1188: mov $0x3c,%rax
118f: syscall
1191: hlt
1192: data16 cs nopw 0x0(%rax,%rax,1)
119d: nopl (%rax)
```
Cc: Bedirhan KURT <windowz414@gnuweeb.org>
Cc: Louvian Lyndal <louvianlyndal@gmail.com>
Reported-by: Peter Cordes <peter@cordes.ca>
Signed-off-by: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
[wt: I did this on purpose due to a misunderstanding of the spec, other
archs will thus have to be rechecked, particularly i386]
Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/nolibc/nolibc.h | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -399,14 +399,20 @@ struct stat {
})
/* startup code */
+/*
+ * x86-64 System V ABI mandates:
+ * 1) %rsp must be 16-byte aligned right before the function call.
+ * 2) The deepest stack frame should be zero (the %rbp).
+ *
+ */
asm(".section .text\n"
".global _start\n"
"_start:\n"
"pop %rdi\n" // argc (first arg, %rdi)
"mov %rsp, %rsi\n" // argv[] (second arg, %rsi)
"lea 8(%rsi,%rdi,8),%rdx\n" // then a NULL then envp (third arg, %rdx)
- "and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned when
- "sub $8, %rsp\n" // entering the callee
+ "xor %ebp, %ebp\n" // zero the stack frame
+ "and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned before call
"call main\n" // main() returns the status code, we'll exit with it.
"movzb %al, %rdi\n" // retrieve exit code from 8 lower bits
"mov $60, %rax\n" // NR_exit == 60
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 029/846] crypto: x86/aesni - dont require alignment of data
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 028/846] tools/nolibc: x86-64: Fix startup code bug Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 030/846] tools/nolibc: i386: fix initial stack alignment Greg Kroah-Hartman
` (820 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Ard Biesheuvel, Herbert Xu
From: Jakub Kicinski <kuba@kernel.org>
commit d480a26bdf872529919e7c30e17f79d0d7b8c4da upstream.
x86 AES-NI routines can deal with unaligned data. Crypto context
(key, iv etc.) have to be aligned but we take care of that separately
by copying it onto the stack. We were feeding unaligned data into
crypto routines up until commit 83c83e658863 ("crypto: aesni -
refactor scatterlist processing") switched to use the full
skcipher API which uses cra_alignmask to decide data alignment.
This fixes 21% performance regression in kTLS.
Tested by booting with CONFIG_CRYPTO_MANAGER_EXTRA_TESTS=y
(and running thru various kTLS packets).
CC: stable@vger.kernel.org # 5.15+
Fixes: 83c83e658863 ("crypto: aesni - refactor scatterlist processing")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/crypto/aesni-intel_glue.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -1107,7 +1107,7 @@ static struct aead_alg aesni_aeads[] = {
.cra_flags = CRYPTO_ALG_INTERNAL,
.cra_blocksize = 1,
.cra_ctxsize = sizeof(struct aesni_rfc4106_gcm_ctx),
- .cra_alignmask = AESNI_ALIGN - 1,
+ .cra_alignmask = 0,
.cra_module = THIS_MODULE,
},
}, {
@@ -1124,7 +1124,7 @@ static struct aead_alg aesni_aeads[] = {
.cra_flags = CRYPTO_ALG_INTERNAL,
.cra_blocksize = 1,
.cra_ctxsize = sizeof(struct generic_gcmaes_ctx),
- .cra_alignmask = AESNI_ALIGN - 1,
+ .cra_alignmask = 0,
.cra_module = THIS_MODULE,
},
} };
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 030/846] tools/nolibc: i386: fix initial stack alignment
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 029/846] crypto: x86/aesni - dont require alignment of data Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 031/846] tools/nolibc: fix incorrect truncation of exit code Greg Kroah-Hartman
` (819 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ammar Faizi, Willy Tarreau, Paul E. McKenney
From: Willy Tarreau <w@1wt.eu>
commit ebbe0d8a449d183fa43b42d84fcb248e25303985 upstream.
After re-checking in the spec and comparing stack offsets with glibc,
The last pushed argument must be 16-byte aligned (i.e. aligned before the
call) so that in the callee esp+4 is multiple of 16, so the principle is
the 32-bit equivalent to what Ammar fixed for x86_64. It's possible that
32-bit code using SSE2 or MMX could have been affected. In addition the
frame pointer ought to be zero at the deepest level.
Link: https://gitlab.com/x86-psABIs/i386-ABI/-/wikis/Intel386-psABI
Cc: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/nolibc/nolibc.h | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -583,13 +583,21 @@ struct sys_stat_struct {
})
/* startup code */
+/*
+ * i386 System V ABI mandates:
+ * 1) last pushed argument must be 16-byte aligned.
+ * 2) The deepest stack frame should be set to zero
+ *
+ */
asm(".section .text\n"
".global _start\n"
"_start:\n"
"pop %eax\n" // argc (first arg, %eax)
"mov %esp, %ebx\n" // argv[] (second arg, %ebx)
"lea 4(%ebx,%eax,4),%ecx\n" // then a NULL then envp (third arg, %ecx)
- "and $-16, %esp\n" // x86 ABI : esp must be 16-byte aligned when
+ "xor %ebp, %ebp\n" // zero the stack frame
+ "and $-16, %esp\n" // x86 ABI : esp must be 16-byte aligned before
+ "sub $4, %esp\n" // the call instruction (args are aligned)
"push %ecx\n" // push all registers on the stack so that we
"push %ebx\n" // support both regparm and plain stack modes
"push %eax\n"
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 031/846] tools/nolibc: fix incorrect truncation of exit code
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 030/846] tools/nolibc: i386: fix initial stack alignment Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 032/846] rtc: cmos: take rtc_lock while reading from CMOS Greg Kroah-Hartman
` (818 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ammar Faizi, Willy Tarreau, Paul E. McKenney
From: Willy Tarreau <w@1wt.eu>
commit de0244ae40ae91145faaf164a4252347607c3711 upstream.
Ammar Faizi reported that our exit code handling is wrong. We truncate
it to the lowest 8 bits but the syscall itself is expected to take a
regular 32-bit signed integer, not an unsigned char. It's the kernel
that later truncates it to the lowest 8 bits. The difference is visible
in strace, where the program below used to show exit(255) instead of
exit(-1):
int main(void)
{
return -1;
}
This patch applies the fix to all archs. x86_64, i386, arm64, armv7 and
mips were all tested and confirmed to work fine now. Risc-v was not
tested but the change is trivial and exactly the same as for other archs.
Reported-by: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/nolibc/nolibc.h | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -414,7 +414,7 @@ asm(".section .text\n"
"xor %ebp, %ebp\n" // zero the stack frame
"and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned before call
"call main\n" // main() returns the status code, we'll exit with it.
- "movzb %al, %rdi\n" // retrieve exit code from 8 lower bits
+ "mov %eax, %edi\n" // retrieve exit code (32 bit)
"mov $60, %rax\n" // NR_exit == 60
"syscall\n" // really exit
"hlt\n" // ensure it does not return
@@ -602,9 +602,9 @@ asm(".section .text\n"
"push %ebx\n" // support both regparm and plain stack modes
"push %eax\n"
"call main\n" // main() returns the status code in %eax
- "movzbl %al, %ebx\n" // retrieve exit code from lower 8 bits
- "movl $1, %eax\n" // NR_exit == 1
- "int $0x80\n" // exit now
+ "mov %eax, %ebx\n" // retrieve exit code (32-bit int)
+ "movl $1, %eax\n" // NR_exit == 1
+ "int $0x80\n" // exit now
"hlt\n" // ensure it does not
"");
@@ -788,7 +788,6 @@ asm(".section .text\n"
"and %r3, %r1, $-8\n" // AAPCS : sp must be 8-byte aligned in the
"mov %sp, %r3\n" // callee, an bl doesn't push (lr=pc)
"bl main\n" // main() returns the status code, we'll exit with it.
- "and %r0, %r0, $0xff\n" // limit exit code to 8 bits
"movs r7, $1\n" // NR_exit == 1
"svc $0x00\n"
"");
@@ -985,7 +984,6 @@ asm(".section .text\n"
"add x2, x2, x1\n" // + argv
"and sp, x1, -16\n" // sp must be 16-byte aligned in the callee
"bl main\n" // main() returns the status code, we'll exit with it.
- "and x0, x0, 0xff\n" // limit exit code to 8 bits
"mov x8, 93\n" // NR_exit == 93
"svc #0\n"
"");
@@ -1190,7 +1188,7 @@ asm(".section .text\n"
"addiu $sp,$sp,-16\n" // the callee expects to save a0..a3 there!
"jal main\n" // main() returns the status code, we'll exit with it.
"nop\n" // delayed slot
- "and $a0, $v0, 0xff\n" // limit exit code to 8 bits
+ "move $a0, $v0\n" // retrieve 32-bit exit code from v0
"li $v0, 4001\n" // NR_exit == 4001
"syscall\n"
".end __start\n"
@@ -1388,7 +1386,6 @@ asm(".section .text\n"
"add a2,a2,a1\n" // + argv
"andi sp,a1,-16\n" // sp must be 16-byte aligned
"call main\n" // main() returns the status code, we'll exit with it.
- "andi a0, a0, 0xff\n" // limit exit code to 8 bits
"li a7, 93\n" // NR_exit == 93
"ecall\n"
"");
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 032/846] rtc: cmos: take rtc_lock while reading from CMOS
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 031/846] tools/nolibc: fix incorrect truncation of exit code Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 033/846] net: phy: marvell: add Marvell specific PHY loopback Greg Kroah-Hartman
` (817 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mateusz Jończyk,
Nobuhiro Iwamatsu, Alessandro Zummo, Alexandre Belloni
From: Mateusz Jończyk <mat.jonczyk@o2.pl>
commit 454f47ff464325223129b9b5b8d0b61946ec704d upstream.
Reading from the CMOS involves writing to the index register and then
reading from the data register. Therefore access to the CMOS has to be
serialized with rtc_lock. This invocation of CMOS_READ was not
serialized, which could cause trouble when other code is accessing CMOS
at the same time.
Use spin_lock_irq() like the rest of the function.
Nothing in kernel modifies the RTC_DM_BINARY bit, so there could be a
separate pair of spin_lock_irq() / spin_unlock_irq() before doing the
math.
Signed-off-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
Reviewed-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: stable@vger.kernel.org
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20211210200131.153887-2-mat.jonczyk@o2.pl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-cmos.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -457,7 +457,10 @@ static int cmos_set_alarm(struct device
min = t->time.tm_min;
sec = t->time.tm_sec;
+ spin_lock_irq(&rtc_lock);
rtc_control = CMOS_READ(RTC_CONTROL);
+ spin_unlock_irq(&rtc_lock);
+
if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
/* Writing 0xff means "don't care" or "match all". */
mon = (mon <= 12) ? bin2bcd(mon) : 0xff;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 033/846] net: phy: marvell: add Marvell specific PHY loopback
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 032/846] rtc: cmos: take rtc_lock while reading from CMOS Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 034/846] ksmbd: uninitialized variable in create_socket() Greg Kroah-Hartman
` (816 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mohammad Athari Bin Ismail, David S. Miller
From: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
commit 020a45aff1190c32b1087cd75b57fbf6bff46ea6 upstream.
Existing genphy_loopback() is not applicable for Marvell PHY. Besides
configuring bit-6 and bit-13 in Page 0 Register 0 (Copper Control
Register), it is also required to configure same bits in Page 2
Register 21 (MAC Specific Control Register 2) according to speed of
the loopback is operating.
Tested working on Marvell88E1510 PHY for all speeds (1000/100/10Mbps).
FIXME: Based on trial and error test, it seem 1G need to have delay between
soft reset and loopback enablement.
Fixes: 014068dcb5b1 ("net: phy: genphy_loopback: add link speed configuration")
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/marvell.c | 56 +++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 55 insertions(+), 1 deletion(-)
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -189,6 +189,8 @@
#define MII_88E1510_GEN_CTRL_REG_1_MODE_RGMII_SGMII 0x4
#define MII_88E1510_GEN_CTRL_REG_1_RESET 0x8000 /* Soft reset */
+#define MII_88E1510_MSCR_2 0x15
+
#define MII_VCT5_TX_RX_MDI0_COUPLING 0x10
#define MII_VCT5_TX_RX_MDI1_COUPLING 0x11
#define MII_VCT5_TX_RX_MDI2_COUPLING 0x12
@@ -1932,6 +1934,58 @@ static void marvell_get_stats(struct phy
data[i] = marvell_get_stat(phydev, i);
}
+static int m88e1510_loopback(struct phy_device *phydev, bool enable)
+{
+ int err;
+
+ if (enable) {
+ u16 bmcr_ctl = 0, mscr2_ctl = 0;
+
+ if (phydev->speed == SPEED_1000)
+ bmcr_ctl = BMCR_SPEED1000;
+ else if (phydev->speed == SPEED_100)
+ bmcr_ctl = BMCR_SPEED100;
+
+ if (phydev->duplex == DUPLEX_FULL)
+ bmcr_ctl |= BMCR_FULLDPLX;
+
+ err = phy_write(phydev, MII_BMCR, bmcr_ctl);
+ if (err < 0)
+ return err;
+
+ if (phydev->speed == SPEED_1000)
+ mscr2_ctl = BMCR_SPEED1000;
+ else if (phydev->speed == SPEED_100)
+ mscr2_ctl = BMCR_SPEED100;
+
+ err = phy_modify_paged(phydev, MII_MARVELL_MSCR_PAGE,
+ MII_88E1510_MSCR_2, BMCR_SPEED1000 |
+ BMCR_SPEED100, mscr2_ctl);
+ if (err < 0)
+ return err;
+
+ /* Need soft reset to have speed configuration takes effect */
+ err = genphy_soft_reset(phydev);
+ if (err < 0)
+ return err;
+
+ /* FIXME: Based on trial and error test, it seem 1G need to have
+ * delay between soft reset and loopback enablement.
+ */
+ if (phydev->speed == SPEED_1000)
+ msleep(1000);
+
+ return phy_modify(phydev, MII_BMCR, BMCR_LOOPBACK,
+ BMCR_LOOPBACK);
+ } else {
+ err = phy_modify(phydev, MII_BMCR, BMCR_LOOPBACK, 0);
+ if (err < 0)
+ return err;
+
+ return phy_config_aneg(phydev);
+ }
+}
+
static int marvell_vct5_wait_complete(struct phy_device *phydev)
{
int i;
@@ -3078,7 +3132,7 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
- .set_loopback = genphy_loopback,
+ .set_loopback = m88e1510_loopback,
.get_tunable = m88e1011_get_tunable,
.set_tunable = m88e1011_set_tunable,
.cable_test_start = marvell_vct7_cable_test_start,
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 034/846] ksmbd: uninitialized variable in create_socket()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 033/846] net: phy: marvell: add Marvell specific PHY loopback Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 035/846] ksmbd: fix guest connection failure with nautilus Greg Kroah-Hartman
` (815 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Namjae Jeon, Steve French
From: Dan Carpenter <dan.carpenter@oracle.com>
commit b207602fb04537cb21ac38fabd7577eca2fa05ae upstream.
The "ksmbd_socket" variable is not initialized on this error path.
Cc: stable@vger.kernel.org
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/transport_tcp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/ksmbd/transport_tcp.c
+++ b/fs/ksmbd/transport_tcp.c
@@ -404,7 +404,7 @@ static int create_socket(struct interfac
&ksmbd_socket);
if (ret) {
pr_err("Can't create socket for ipv4: %d\n", ret);
- goto out_error;
+ goto out_clear;
}
sin.sin_family = PF_INET;
@@ -462,6 +462,7 @@ static int create_socket(struct interfac
out_error:
tcp_destroy_socket(ksmbd_socket);
+out_clear:
iface->ksmbd_socket = NULL;
return ret;
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 035/846] ksmbd: fix guest connection failure with nautilus
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 034/846] ksmbd: uninitialized variable in create_socket() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 036/846] ksmbd: add support for smb2 max credit parameter Greg Kroah-Hartman
` (814 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit ac090d9c90b087d6fb714e54b2a6dd1e6c373ed6 upstream.
MS-SMB2 describe session sign like the following.
Session.SigningRequired MUST be set to TRUE under the following conditions:
- If the SMB2_NEGOTIATE_SIGNING_REQUIRED bit is set in the SecurityMode
field of the client request.
- If the SMB2_SESSION_FLAG_IS_GUEST bit is not set in the SessionFlags
field and Session.IsAnonymous is FALSE and either Connection.ShouldSign
or global RequireMessageSigning is TRUE.
When trying guest account connection using nautilus, The login failure
happened on session setup. ksmbd does not allow this connection
when the user is a guest and the connection sign is set. Just do not set
session sign instead of error response as described in the specification.
And this change improves the guest connection in Nautilus.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org # v5.15+
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2pdu.c | 64 ++++++++++++++++++++++++-----------------------------
1 file changed, 30 insertions(+), 34 deletions(-)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -1457,11 +1457,6 @@ static int ntlm_authenticate(struct ksmb
sess->user = user;
if (user_guest(sess->user)) {
- if (conn->sign) {
- ksmbd_debug(SMB, "Guest login not allowed when signing enabled\n");
- return -EPERM;
- }
-
rsp->SessionFlags = SMB2_SESSION_FLAG_IS_GUEST_LE;
} else {
struct authenticate_message *authblob;
@@ -1474,38 +1469,39 @@ static int ntlm_authenticate(struct ksmb
ksmbd_debug(SMB, "authentication failed\n");
return -EPERM;
}
+ }
- /*
- * If session state is SMB2_SESSION_VALID, We can assume
- * that it is reauthentication. And the user/password
- * has been verified, so return it here.
- */
- if (sess->state == SMB2_SESSION_VALID) {
- if (conn->binding)
- goto binding_session;
- return 0;
- }
+ /*
+ * If session state is SMB2_SESSION_VALID, We can assume
+ * that it is reauthentication. And the user/password
+ * has been verified, so return it here.
+ */
+ if (sess->state == SMB2_SESSION_VALID) {
+ if (conn->binding)
+ goto binding_session;
+ return 0;
+ }
- if ((conn->sign || server_conf.enforced_signing) ||
- (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED))
- sess->sign = true;
-
- if (smb3_encryption_negotiated(conn) &&
- !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {
- rc = conn->ops->generate_encryptionkey(sess);
- if (rc) {
- ksmbd_debug(SMB,
- "SMB3 encryption key generation failed\n");
- return -EINVAL;
- }
- sess->enc = true;
- rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE;
- /*
- * signing is disable if encryption is enable
- * on this session
- */
- sess->sign = false;
+ if ((rsp->SessionFlags != SMB2_SESSION_FLAG_IS_GUEST_LE &&
+ (conn->sign || server_conf.enforced_signing)) ||
+ (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED))
+ sess->sign = true;
+
+ if (smb3_encryption_negotiated(conn) &&
+ !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {
+ rc = conn->ops->generate_encryptionkey(sess);
+ if (rc) {
+ ksmbd_debug(SMB,
+ "SMB3 encryption key generation failed\n");
+ return -EINVAL;
}
+ sess->enc = true;
+ rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE;
+ /*
+ * signing is disable if encryption is enable
+ * on this session
+ */
+ sess->sign = false;
}
binding_session:
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 036/846] ksmbd: add support for smb2 max credit parameter
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 035/846] ksmbd: fix guest connection failure with nautilus Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 037/846] ksmbd: move credit charge deduction under processing request Greg Kroah-Hartman
` (813 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 004443b3f6d722b455cf963ed7c3edd7f4772405 upstream.
Add smb2 max credits parameter to adjust maximum credits value to limit
number of outstanding requests.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/connection.h | 1 -
fs/ksmbd/ksmbd_netlink.h | 1 +
fs/ksmbd/smb2misc.c | 2 +-
fs/ksmbd/smb2ops.c | 16 ++++++++++++----
fs/ksmbd/smb2pdu.c | 8 ++++----
fs/ksmbd/smb2pdu.h | 1 +
fs/ksmbd/smb_common.h | 1 +
fs/ksmbd/transport_ipc.c | 2 ++
8 files changed, 22 insertions(+), 10 deletions(-)
--- a/fs/ksmbd/connection.h
+++ b/fs/ksmbd/connection.h
@@ -62,7 +62,6 @@ struct ksmbd_conn {
/* References which are made for this Server object*/
atomic_t r_count;
unsigned short total_credits;
- unsigned short max_credits;
spinlock_t credits_lock;
wait_queue_head_t req_running_q;
/* Lock to protect requests list*/
--- a/fs/ksmbd/ksmbd_netlink.h
+++ b/fs/ksmbd/ksmbd_netlink.h
@@ -103,6 +103,7 @@ struct ksmbd_startup_request {
* we set the SPARSE_FILES bit (0x40).
*/
__u32 sub_auth[3]; /* Subauth value for Security ID */
+ __u32 smb2_max_credits; /* MAX credits */
__u32 ifc_list_sz; /* interfaces list size */
__s8 ____payload[];
};
--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -327,7 +327,7 @@ static int smb2_validate_credit_charge(s
ksmbd_debug(SMB, "Insufficient credit charge, given: %d, needed: %d\n",
credit_charge, calc_credit_num);
return 1;
- } else if (credit_charge > conn->max_credits) {
+ } else if (credit_charge > conn->vals->max_credits) {
ksmbd_debug(SMB, "Too large credit charge: %d\n", credit_charge);
return 1;
}
--- a/fs/ksmbd/smb2ops.c
+++ b/fs/ksmbd/smb2ops.c
@@ -20,6 +20,7 @@ static struct smb_version_values smb21_s
.max_read_size = SMB21_DEFAULT_IOSIZE,
.max_write_size = SMB21_DEFAULT_IOSIZE,
.max_trans_size = SMB21_DEFAULT_IOSIZE,
+ .max_credits = SMB2_MAX_CREDITS,
.large_lock_type = 0,
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
.shared_lock_type = SMB2_LOCKFLAG_SHARED,
@@ -45,6 +46,7 @@ static struct smb_version_values smb30_s
.max_read_size = SMB3_DEFAULT_IOSIZE,
.max_write_size = SMB3_DEFAULT_IOSIZE,
.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+ .max_credits = SMB2_MAX_CREDITS,
.large_lock_type = 0,
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
.shared_lock_type = SMB2_LOCKFLAG_SHARED,
@@ -71,6 +73,7 @@ static struct smb_version_values smb302_
.max_read_size = SMB3_DEFAULT_IOSIZE,
.max_write_size = SMB3_DEFAULT_IOSIZE,
.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+ .max_credits = SMB2_MAX_CREDITS,
.large_lock_type = 0,
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
.shared_lock_type = SMB2_LOCKFLAG_SHARED,
@@ -97,6 +100,7 @@ static struct smb_version_values smb311_
.max_read_size = SMB3_DEFAULT_IOSIZE,
.max_write_size = SMB3_DEFAULT_IOSIZE,
.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+ .max_credits = SMB2_MAX_CREDITS,
.large_lock_type = 0,
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
.shared_lock_type = SMB2_LOCKFLAG_SHARED,
@@ -198,7 +202,6 @@ void init_smb2_1_server(struct ksmbd_con
conn->ops = &smb2_0_server_ops;
conn->cmds = smb2_0_server_cmds;
conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
- conn->max_credits = SMB2_MAX_CREDITS;
conn->signing_algorithm = SIGNING_ALG_HMAC_SHA256;
if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
@@ -216,7 +219,6 @@ void init_smb3_0_server(struct ksmbd_con
conn->ops = &smb3_0_server_ops;
conn->cmds = smb2_0_server_cmds;
conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
- conn->max_credits = SMB2_MAX_CREDITS;
conn->signing_algorithm = SIGNING_ALG_AES_CMAC;
if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
@@ -241,7 +243,6 @@ void init_smb3_02_server(struct ksmbd_co
conn->ops = &smb3_0_server_ops;
conn->cmds = smb2_0_server_cmds;
conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
- conn->max_credits = SMB2_MAX_CREDITS;
conn->signing_algorithm = SIGNING_ALG_AES_CMAC;
if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
@@ -266,7 +267,6 @@ int init_smb3_11_server(struct ksmbd_con
conn->ops = &smb3_11_server_ops;
conn->cmds = smb2_0_server_cmds;
conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
- conn->max_credits = SMB2_MAX_CREDITS;
conn->signing_algorithm = SIGNING_ALG_AES_CMAC;
if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
@@ -305,3 +305,11 @@ void init_smb2_max_trans_size(unsigned i
smb302_server_values.max_trans_size = sz;
smb311_server_values.max_trans_size = sz;
}
+
+void init_smb2_max_credits(unsigned int sz)
+{
+ smb21_server_values.max_credits = sz;
+ smb30_server_values.max_credits = sz;
+ smb302_server_values.max_credits = sz;
+ smb311_server_values.max_credits = sz;
+}
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -310,7 +310,7 @@ int smb2_set_rsp_credits(struct ksmbd_wo
hdr->CreditCharge = req_hdr->CreditCharge;
- if (conn->total_credits > conn->max_credits) {
+ if (conn->total_credits > conn->vals->max_credits) {
hdr->CreditRequest = 0;
pr_err("Total credits overflow: %d\n", conn->total_credits);
return -EINVAL;
@@ -331,12 +331,12 @@ int smb2_set_rsp_credits(struct ksmbd_wo
if (hdr->Command == SMB2_NEGOTIATE)
aux_max = 0;
else
- aux_max = conn->max_credits - credit_charge;
+ aux_max = conn->vals->max_credits - credit_charge;
aux_credits = min_t(unsigned short, aux_credits, aux_max);
credits_granted = credit_charge + aux_credits;
- if (conn->max_credits - conn->total_credits < credits_granted)
- credits_granted = conn->max_credits -
+ if (conn->vals->max_credits - conn->total_credits < credits_granted)
+ credits_granted = conn->vals->max_credits -
conn->total_credits;
conn->total_credits += credits_granted;
--- a/fs/ksmbd/smb2pdu.h
+++ b/fs/ksmbd/smb2pdu.h
@@ -1647,6 +1647,7 @@ int init_smb3_11_server(struct ksmbd_con
void init_smb2_max_read_size(unsigned int sz);
void init_smb2_max_write_size(unsigned int sz);
void init_smb2_max_trans_size(unsigned int sz);
+void init_smb2_max_credits(unsigned int sz);
bool is_smb2_neg_cmd(struct ksmbd_work *work);
bool is_smb2_rsp(struct ksmbd_work *work);
--- a/fs/ksmbd/smb_common.h
+++ b/fs/ksmbd/smb_common.h
@@ -412,6 +412,7 @@ struct smb_version_values {
__u32 max_read_size;
__u32 max_write_size;
__u32 max_trans_size;
+ __u32 max_credits;
__u32 large_lock_type;
__u32 exclusive_lock_type;
__u32 shared_lock_type;
--- a/fs/ksmbd/transport_ipc.c
+++ b/fs/ksmbd/transport_ipc.c
@@ -301,6 +301,8 @@ static int ipc_server_config_on_startup(
init_smb2_max_write_size(req->smb2_max_write);
if (req->smb2_max_trans)
init_smb2_max_trans_size(req->smb2_max_trans);
+ if (req->smb2_max_credits)
+ init_smb2_max_credits(req->smb2_max_credits);
ret = ksmbd_set_netbios_name(req->netbios_name);
ret |= ksmbd_set_server_string(req->server_string);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 037/846] ksmbd: move credit charge deduction under processing request
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 036/846] ksmbd: add support for smb2 max credit parameter Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 038/846] ksmbd: limits exceeding the maximum allowable outstanding requests Greg Kroah-Hartman
` (812 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 914d7e5709ac59ded70bea7956d408fe2acd7c3c upstream.
Moves the credit charge deduction from total_credits under the processing
a request. When repeating smb2 lock request and other command request,
there will be a problem that ->total_credits does not decrease.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2misc.c | 7 ++-----
fs/ksmbd/smb2pdu.c | 16 ++++++++++------
2 files changed, 12 insertions(+), 11 deletions(-)
--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -290,7 +290,7 @@ static int smb2_validate_credit_charge(s
unsigned int req_len = 0, expect_resp_len = 0, calc_credit_num, max_len;
unsigned short credit_charge = le16_to_cpu(hdr->CreditCharge);
void *__hdr = hdr;
- int ret;
+ int ret = 0;
switch (hdr->Command) {
case SMB2_QUERY_INFO:
@@ -333,10 +333,7 @@ static int smb2_validate_credit_charge(s
}
spin_lock(&conn->credits_lock);
- if (credit_charge <= conn->total_credits) {
- conn->total_credits -= credit_charge;
- ret = 0;
- } else {
+ if (credit_charge > conn->total_credits) {
ksmbd_debug(SMB, "Insufficient credits granted, given: %u, granted: %u\n",
credit_charge, conn->total_credits);
ret = 1;
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -301,9 +301,8 @@ int smb2_set_rsp_credits(struct ksmbd_wo
struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work);
struct smb2_hdr *hdr = ksmbd_resp_buf_next(work);
struct ksmbd_conn *conn = work->conn;
- unsigned short credits_requested;
+ unsigned short credits_requested, aux_max;
unsigned short credit_charge, credits_granted = 0;
- unsigned short aux_max, aux_credits;
if (work->send_no_response)
return 0;
@@ -318,6 +317,13 @@ int smb2_set_rsp_credits(struct ksmbd_wo
credit_charge = max_t(unsigned short,
le16_to_cpu(req_hdr->CreditCharge), 1);
+ if (credit_charge > conn->total_credits) {
+ ksmbd_debug(SMB, "Insufficient credits granted, given: %u, granted: %u\n",
+ credit_charge, conn->total_credits);
+ return -EINVAL;
+ }
+
+ conn->total_credits -= credit_charge;
credits_requested = max_t(unsigned short,
le16_to_cpu(req_hdr->CreditRequest), 1);
@@ -327,13 +333,11 @@ int smb2_set_rsp_credits(struct ksmbd_wo
* TODO: Need to adjuct CreditRequest value according to
* current cpu load
*/
- aux_credits = credits_requested - 1;
if (hdr->Command == SMB2_NEGOTIATE)
- aux_max = 0;
+ aux_max = 1;
else
aux_max = conn->vals->max_credits - credit_charge;
- aux_credits = min_t(unsigned short, aux_credits, aux_max);
- credits_granted = credit_charge + aux_credits;
+ credits_granted = min_t(unsigned short, credits_requested, aux_max);
if (conn->vals->max_credits - conn->total_credits < credits_granted)
credits_granted = conn->vals->max_credits -
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 038/846] ksmbd: limits exceeding the maximum allowable outstanding requests
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 037/846] ksmbd: move credit charge deduction under processing request Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 039/846] ksmbd: add reserved room in ipc request/response Greg Kroah-Hartman
` (811 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit b589f5db6d4af8f14d70e31e1276b4c017668a26 upstream.
If the client ignores the CreditResponse received from the server and
continues to send the request, ksmbd limits the requests if it exceeds
smb2 max credits.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/connection.c | 1 +
fs/ksmbd/connection.h | 3 ++-
fs/ksmbd/smb2misc.c | 9 +++++++++
fs/ksmbd/smb2pdu.c | 1 +
4 files changed, 13 insertions(+), 1 deletion(-)
--- a/fs/ksmbd/connection.c
+++ b/fs/ksmbd/connection.c
@@ -62,6 +62,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void
atomic_set(&conn->req_running, 0);
atomic_set(&conn->r_count, 0);
conn->total_credits = 1;
+ conn->outstanding_credits = 1;
init_waitqueue_head(&conn->req_running_q);
INIT_LIST_HEAD(&conn->conns_list);
--- a/fs/ksmbd/connection.h
+++ b/fs/ksmbd/connection.h
@@ -61,7 +61,8 @@ struct ksmbd_conn {
atomic_t req_running;
/* References which are made for this Server object*/
atomic_t r_count;
- unsigned short total_credits;
+ unsigned int total_credits;
+ unsigned int outstanding_credits;
spinlock_t credits_lock;
wait_queue_head_t req_running_q;
/* Lock to protect requests list*/
--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -338,7 +338,16 @@ static int smb2_validate_credit_charge(s
credit_charge, conn->total_credits);
ret = 1;
}
+
+ if ((u64)conn->outstanding_credits + credit_charge > conn->vals->max_credits) {
+ ksmbd_debug(SMB, "Limits exceeding the maximum allowable outstanding requests, given : %u, pending : %u\n",
+ credit_charge, conn->outstanding_credits);
+ ret = 1;
+ } else
+ conn->outstanding_credits += credit_charge;
+
spin_unlock(&conn->credits_lock);
+
return ret;
}
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -324,6 +324,7 @@ int smb2_set_rsp_credits(struct ksmbd_wo
}
conn->total_credits -= credit_charge;
+ conn->outstanding_credits -= credit_charge;
credits_requested = max_t(unsigned short,
le16_to_cpu(req_hdr->CreditRequest), 1);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 039/846] ksmbd: add reserved room in ipc request/response
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 038/846] ksmbd: limits exceeding the maximum allowable outstanding requests Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 040/846] media: cec: fix a deadlock situation Greg Kroah-Hartman
` (810 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 41dbda16a0902798e732abc6599de256b9dc3b27 upstream.
Whenever new parameter is added to smb configuration, It is possible
to break the execution of the IPC daemon by mismatch size of
request/response. This patch tries to reserve space in ipc request/response
in advance to prevent that.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/ksmbd_netlink.h | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/ksmbd/ksmbd_netlink.h
+++ b/fs/ksmbd/ksmbd_netlink.h
@@ -104,6 +104,7 @@ struct ksmbd_startup_request {
*/
__u32 sub_auth[3]; /* Subauth value for Security ID */
__u32 smb2_max_credits; /* MAX credits */
+ __u32 reserved[128]; /* Reserved room */
__u32 ifc_list_sz; /* interfaces list size */
__s8 ____payload[];
};
@@ -114,7 +115,7 @@ struct ksmbd_startup_request {
* IPC request to shutdown ksmbd server.
*/
struct ksmbd_shutdown_request {
- __s32 reserved;
+ __s32 reserved[16];
};
/*
@@ -123,6 +124,7 @@ struct ksmbd_shutdown_request {
struct ksmbd_login_request {
__u32 handle;
__s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; /* user account name */
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -136,6 +138,7 @@ struct ksmbd_login_response {
__u16 status;
__u16 hash_sz; /* hash size */
__s8 hash[KSMBD_REQ_MAX_HASH_SZ]; /* password hash */
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -144,6 +147,7 @@ struct ksmbd_login_response {
struct ksmbd_share_config_request {
__u32 handle;
__s8 share_name[KSMBD_REQ_MAX_SHARE_NAME]; /* share name */
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -158,6 +162,7 @@ struct ksmbd_share_config_response {
__u16 force_directory_mode;
__u16 force_uid;
__u16 force_gid;
+ __u32 reserved[128]; /* Reserved room */
__u32 veto_list_sz;
__s8 ____payload[];
};
@@ -188,6 +193,7 @@ struct ksmbd_tree_connect_request {
__s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ];
__s8 share[KSMBD_REQ_MAX_SHARE_NAME];
__s8 peer_addr[64];
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -197,6 +203,7 @@ struct ksmbd_tree_connect_response {
__u32 handle;
__u16 status;
__u16 connection_flags;
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -205,6 +212,7 @@ struct ksmbd_tree_connect_response {
struct ksmbd_tree_disconnect_request {
__u64 session_id; /* session id */
__u64 connect_id; /* tree connection id */
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -213,6 +221,7 @@ struct ksmbd_tree_disconnect_request {
struct ksmbd_logout_request {
__s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; /* user account name */
__u32 account_flags;
+ __u32 reserved[16]; /* Reserved room */
};
/*
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 040/846] media: cec: fix a deadlock situation
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 039/846] ksmbd: add reserved room in ipc request/response Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 041/846] media: ov8865: Disable only enabled regulators on error path Greg Kroah-Hartman
` (809 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
commit a9e6107616bb8108aa4fc22584a05e69761a91f7 upstream.
The cec_devnode struct has a lock meant to serialize access
to the fields of this struct. This lock is taken during
device node (un)registration and when opening or releasing a
filehandle to the device node. When the last open filehandle
is closed the cec adapter might be disabled by calling the
adap_enable driver callback with the devnode.lock held.
However, if during that callback a message or event arrives
then the driver will call one of the cec_queue_event()
variants in cec-adap.c, and those will take the same devnode.lock
to walk the open filehandle list.
This obviously causes a deadlock.
This is quite easy to reproduce with the cec-gpio driver since that
uses the cec-pin framework which generated lots of events and uses
a kernel thread for the processing, so when adap_enable is called
the thread is still running and can generate events.
But I suspect that it might also happen with other drivers if an
interrupt arrives signaling e.g. a received message before adap_enable
had a chance to disable the interrupts.
This patch adds a new mutex to serialize access to the fhs list.
When adap_enable() is called the devnode.lock mutex is held, but
not devnode.lock_fhs. The event functions in cec-adap.c will now
use devnode.lock_fhs instead of devnode.lock, ensuring that it is
safe to call those functions from the adap_enable callback.
This specific issue only happens if the last open filehandle is closed
and the physical address is invalid. This is not something that
happens during normal operation, but it does happen when monitoring
CEC traffic (e.g. cec-ctl --monitor) with an unconfigured CEC adapter.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: <stable@vger.kernel.org> # for v5.13 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/core/cec-adap.c | 38 +++++++++++++++++++++-----------------
drivers/media/cec/core/cec-api.c | 6 ++++++
drivers/media/cec/core/cec-core.c | 3 +++
include/media/cec.h | 11 +++++++++--
4 files changed, 39 insertions(+), 19 deletions(-)
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -161,10 +161,10 @@ static void cec_queue_event(struct cec_a
u64 ts = ktime_get_ns();
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list)
cec_queue_event_fh(fh, ev, ts);
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
/* Notify userspace that the CEC pin changed state at the given time. */
@@ -178,11 +178,12 @@ void cec_queue_pin_cec_event(struct cec_
};
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
- list_for_each_entry(fh, &adap->devnode.fhs, list)
+ mutex_lock(&adap->devnode.lock_fhs);
+ list_for_each_entry(fh, &adap->devnode.fhs, list) {
if (fh->mode_follower == CEC_MODE_MONITOR_PIN)
cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
- mutex_unlock(&adap->devnode.lock);
+ }
+ mutex_unlock(&adap->devnode.lock_fhs);
}
EXPORT_SYMBOL_GPL(cec_queue_pin_cec_event);
@@ -195,10 +196,10 @@ void cec_queue_pin_hpd_event(struct cec_
};
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list)
cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
EXPORT_SYMBOL_GPL(cec_queue_pin_hpd_event);
@@ -211,10 +212,10 @@ void cec_queue_pin_5v_event(struct cec_a
};
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list)
cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
EXPORT_SYMBOL_GPL(cec_queue_pin_5v_event);
@@ -286,12 +287,12 @@ static void cec_queue_msg_monitor(struct
u32 monitor_mode = valid_la ? CEC_MODE_MONITOR :
CEC_MODE_MONITOR_ALL;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list) {
if (fh->mode_follower >= monitor_mode)
cec_queue_msg_fh(fh, msg);
}
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
/*
@@ -302,12 +303,12 @@ static void cec_queue_msg_followers(stru
{
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list) {
if (fh->mode_follower == CEC_MODE_FOLLOWER)
cec_queue_msg_fh(fh, msg);
}
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
/* Notify userspace of an adapter state change. */
@@ -1573,6 +1574,7 @@ void __cec_s_phys_addr(struct cec_adapte
/* Disabling monitor all mode should always succeed */
if (adap->monitor_all_cnt)
WARN_ON(call_op(adap, adap_monitor_all_enable, false));
+ /* serialize adap_enable */
mutex_lock(&adap->devnode.lock);
if (adap->needs_hpd || list_empty(&adap->devnode.fhs)) {
WARN_ON(adap->ops->adap_enable(adap, false));
@@ -1584,14 +1586,16 @@ void __cec_s_phys_addr(struct cec_adapte
return;
}
+ /* serialize adap_enable */
mutex_lock(&adap->devnode.lock);
adap->last_initiator = 0xff;
adap->transmit_in_progress = false;
- if ((adap->needs_hpd || list_empty(&adap->devnode.fhs)) &&
- adap->ops->adap_enable(adap, true)) {
- mutex_unlock(&adap->devnode.lock);
- return;
+ if (adap->needs_hpd || list_empty(&adap->devnode.fhs)) {
+ if (adap->ops->adap_enable(adap, true)) {
+ mutex_unlock(&adap->devnode.lock);
+ return;
+ }
}
if (adap->monitor_all_cnt &&
--- a/drivers/media/cec/core/cec-api.c
+++ b/drivers/media/cec/core/cec-api.c
@@ -586,6 +586,7 @@ static int cec_open(struct inode *inode,
return err;
}
+ /* serialize adap_enable */
mutex_lock(&devnode->lock);
if (list_empty(&devnode->fhs) &&
!adap->needs_hpd &&
@@ -624,7 +625,9 @@ static int cec_open(struct inode *inode,
}
#endif
+ mutex_lock(&devnode->lock_fhs);
list_add(&fh->list, &devnode->fhs);
+ mutex_unlock(&devnode->lock_fhs);
mutex_unlock(&devnode->lock);
return 0;
@@ -653,8 +656,11 @@ static int cec_release(struct inode *ino
cec_monitor_all_cnt_dec(adap);
mutex_unlock(&adap->lock);
+ /* serialize adap_enable */
mutex_lock(&devnode->lock);
+ mutex_lock(&devnode->lock_fhs);
list_del(&fh->list);
+ mutex_unlock(&devnode->lock_fhs);
if (cec_is_registered(adap) && list_empty(&devnode->fhs) &&
!adap->needs_hpd && adap->phys_addr == CEC_PHYS_ADDR_INVALID) {
WARN_ON(adap->ops->adap_enable(adap, false));
--- a/drivers/media/cec/core/cec-core.c
+++ b/drivers/media/cec/core/cec-core.c
@@ -169,8 +169,10 @@ static void cec_devnode_unregister(struc
devnode->registered = false;
devnode->unregistered = true;
+ mutex_lock(&devnode->lock_fhs);
list_for_each_entry(fh, &devnode->fhs, list)
wake_up_interruptible(&fh->wait);
+ mutex_unlock(&devnode->lock_fhs);
mutex_unlock(&devnode->lock);
@@ -272,6 +274,7 @@ struct cec_adapter *cec_allocate_adapter
/* adap->devnode initialization */
INIT_LIST_HEAD(&adap->devnode.fhs);
+ mutex_init(&adap->devnode.lock_fhs);
mutex_init(&adap->devnode.lock);
adap->kthread = kthread_run(cec_thread_func, adap, "cec-%s", name);
--- a/include/media/cec.h
+++ b/include/media/cec.h
@@ -26,13 +26,17 @@
* @dev: cec device
* @cdev: cec character device
* @minor: device node minor number
+ * @lock: lock to serialize open/release and registration
* @registered: the device was correctly registered
* @unregistered: the device was unregistered
+ * @lock_fhs: lock to control access to @fhs
* @fhs: the list of open filehandles (cec_fh)
- * @lock: lock to control access to this structure
*
* This structure represents a cec-related device node.
*
+ * To add or remove filehandles from @fhs the @lock must be taken first,
+ * followed by @lock_fhs. It is safe to access @fhs if either lock is held.
+ *
* The @parent is a physical device. It must be set by core or device drivers
* before registering the node.
*/
@@ -43,10 +47,13 @@ struct cec_devnode {
/* device info */
int minor;
+ /* serialize open/release and registration */
+ struct mutex lock;
bool registered;
bool unregistered;
+ /* protect access to fhs */
+ struct mutex lock_fhs;
struct list_head fhs;
- struct mutex lock;
};
struct cec_adapter;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 041/846] media: ov8865: Disable only enabled regulators on error path
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 040/846] media: cec: fix a deadlock situation Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 042/846] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE Greg Kroah-Hartman
` (808 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Mauro Carvalho Chehab
From: Sakari Ailus <sakari.ailus@linux.intel.com>
commit cbe0b3af73bf72fad197756f026084404e2bcdc7 upstream.
If powering on the sensor failed, the entire power-off sequence was run
independently of how far the power-on sequence proceeded before the error.
This lead to disabling regulators and/or clock that was not enabled.
Fix this by disabling only clocks and regulators that were enabled
previously.
Fixes: 11c0d8fdccc5 ("media: i2c: Add support for the OV8865 image sensor")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov8865.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/media/i2c/ov8865.c
+++ b/drivers/media/i2c/ov8865.c
@@ -2330,27 +2330,27 @@ static int ov8865_sensor_power(struct ov
if (ret) {
dev_err(sensor->dev,
"failed to enable DOVDD regulator\n");
- goto disable;
+ return ret;
}
ret = regulator_enable(sensor->avdd);
if (ret) {
dev_err(sensor->dev,
"failed to enable AVDD regulator\n");
- goto disable;
+ goto disable_dovdd;
}
ret = regulator_enable(sensor->dvdd);
if (ret) {
dev_err(sensor->dev,
"failed to enable DVDD regulator\n");
- goto disable;
+ goto disable_avdd;
}
ret = clk_prepare_enable(sensor->extclk);
if (ret) {
dev_err(sensor->dev, "failed to enable EXTCLK clock\n");
- goto disable;
+ goto disable_dvdd;
}
gpiod_set_value_cansleep(sensor->reset, 0);
@@ -2359,14 +2359,16 @@ static int ov8865_sensor_power(struct ov
/* Time to enter streaming mode according to power timings. */
usleep_range(10000, 12000);
} else {
-disable:
gpiod_set_value_cansleep(sensor->powerdown, 1);
gpiod_set_value_cansleep(sensor->reset, 1);
clk_disable_unprepare(sensor->extclk);
+disable_dvdd:
regulator_disable(sensor->dvdd);
+disable_avdd:
regulator_disable(sensor->avdd);
+disable_dovdd:
regulator_disable(sensor->dovdd);
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 042/846] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 041/846] media: ov8865: Disable only enabled regulators on error path Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 043/846] media: flexcop-usb: fix control-message timeouts Greg Kroah-Hartman
` (807 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
commit cd9d9377ed235b294a492a094e1666178a5e78fd upstream.
If V4L2_CAP_READWRITE is not set, then readbuffers must be set to 0,
otherwise v4l2-compliance will complain.
A note on the Fixes tag below: this patch does not really fix that commit,
but it can be applied from that commit onwards. For older code there is no
guarantee that device_caps is set, so even though this patch would apply,
it will not work reliably.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 049e684f2de9 (media: v4l2-dev: fix WARN_ON(!vdev->device_caps))
Cc: <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2088,6 +2088,7 @@ static int v4l_prepare_buf(const struct
static int v4l_g_parm(const struct v4l2_ioctl_ops *ops,
struct file *file, void *fh, void *arg)
{
+ struct video_device *vfd = video_devdata(file);
struct v4l2_streamparm *p = arg;
v4l2_std_id std;
int ret = check_fmt(file, p->type);
@@ -2099,7 +2100,8 @@ static int v4l_g_parm(const struct v4l2_
if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE &&
p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
return -EINVAL;
- p->parm.capture.readbuffers = 2;
+ if (vfd->device_caps & V4L2_CAP_READWRITE)
+ p->parm.capture.readbuffers = 2;
ret = ops->vidioc_g_std(file, fh, &std);
if (ret == 0)
v4l2_video_std_frame_period(std, &p->parm.capture.timeperframe);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 043/846] media: flexcop-usb: fix control-message timeouts
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 042/846] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 044/846] media: mceusb: " Greg Kroah-Hartman
` (806 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit cd1798a387825cc4a51282f5a611ad05bb1ad75f upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Note that the driver was multiplying some of the timeout values with HZ
twice resulting in 3000-second timeouts with HZ=1000.
Also note that two of the timeout defines are currently unused.
Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Cc: stable@vger.kernel.org # 3.0
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/b2c2/flexcop-usb.c | 10 +++++-----
drivers/media/usb/b2c2/flexcop-usb.h | 12 ++++++------
2 files changed, 11 insertions(+), 11 deletions(-)
--- a/drivers/media/usb/b2c2/flexcop-usb.c
+++ b/drivers/media/usb/b2c2/flexcop-usb.c
@@ -87,7 +87,7 @@ static int flexcop_usb_readwrite_dw(stru
0,
fc_usb->data,
sizeof(u32),
- B2C2_WAIT_FOR_OPERATION_RDW * HZ);
+ B2C2_WAIT_FOR_OPERATION_RDW);
if (ret != sizeof(u32)) {
err("error while %s dword from %d (%d).", read ? "reading" :
@@ -155,7 +155,7 @@ static int flexcop_usb_v8_memory_req(str
wIndex,
fc_usb->data,
buflen,
- nWaitTime * HZ);
+ nWaitTime);
if (ret != buflen)
ret = -EIO;
@@ -248,13 +248,13 @@ static int flexcop_usb_i2c_req(struct fl
/* DKT 020208 - add this to support special case of DiSEqC */
case USB_FUNC_I2C_CHECKWRITE:
pipe = B2C2_USB_CTRL_PIPE_OUT;
- nWaitTime = 2;
+ nWaitTime = 2000;
request_type |= USB_DIR_OUT;
break;
case USB_FUNC_I2C_READ:
case USB_FUNC_I2C_REPEATREAD:
pipe = B2C2_USB_CTRL_PIPE_IN;
- nWaitTime = 2;
+ nWaitTime = 2000;
request_type |= USB_DIR_IN;
break;
default:
@@ -281,7 +281,7 @@ static int flexcop_usb_i2c_req(struct fl
wIndex,
fc_usb->data,
buflen,
- nWaitTime * HZ);
+ nWaitTime);
if (ret != buflen)
ret = -EIO;
--- a/drivers/media/usb/b2c2/flexcop-usb.h
+++ b/drivers/media/usb/b2c2/flexcop-usb.h
@@ -91,13 +91,13 @@ typedef enum {
UTILITY_SRAM_TESTVERIFY = 0x16,
} flexcop_usb_utility_function_t;
-#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ)
-#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ)
+#define B2C2_WAIT_FOR_OPERATION_RW 1000
+#define B2C2_WAIT_FOR_OPERATION_RDW 3000
+#define B2C2_WAIT_FOR_OPERATION_WDW 1000
-#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ)
+#define B2C2_WAIT_FOR_OPERATION_V8READ 3000
+#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000
+#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000
typedef enum {
V8_MEMORY_PAGE_DVB_CI = 0x20,
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 044/846] media: mceusb: fix control-message timeouts
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 043/846] media: flexcop-usb: fix control-message timeouts Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 045/846] media: em28xx: " Greg Kroah-Hartman
` (805 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 16394e998cbb050730536bdf7e89f5a70efbd974 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver")
Cc: stable@vger.kernel.org # 2.6.36
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/mceusb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1430,7 +1430,7 @@ static void mceusb_gen1_init(struct mceu
*/
ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0,
- data, USB_CTRL_MSG_SZ, HZ * 3);
+ data, USB_CTRL_MSG_SZ, 3000);
dev_dbg(dev, "set address - ret = %d", ret);
dev_dbg(dev, "set address - data[0] = %d, data[1] = %d",
data[0], data[1]);
@@ -1438,20 +1438,20 @@ static void mceusb_gen1_init(struct mceu
/* set feature: bit rate 38400 bps */
ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
USB_REQ_SET_FEATURE, USB_TYPE_VENDOR,
- 0xc04e, 0x0000, NULL, 0, HZ * 3);
+ 0xc04e, 0x0000, NULL, 0, 3000);
dev_dbg(dev, "set feature - ret = %d", ret);
/* bRequest 4: set char length to 8 bits */
ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
4, USB_TYPE_VENDOR,
- 0x0808, 0x0000, NULL, 0, HZ * 3);
+ 0x0808, 0x0000, NULL, 0, 3000);
dev_dbg(dev, "set char length - retB = %d", ret);
/* bRequest 2: set handshaking to use DTR/DSR */
ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
2, USB_TYPE_VENDOR,
- 0x0000, 0x0100, NULL, 0, HZ * 3);
+ 0x0000, 0x0100, NULL, 0, 3000);
dev_dbg(dev, "set handshake - retC = %d", ret);
/* device resume */
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 045/846] media: em28xx: fix control-message timeouts
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 044/846] media: mceusb: " Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 046/846] media: cpia2: " Greg Kroah-Hartman
` (804 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: a6c2ba283565 ("[PATCH] v4l: 716: support for em28xx board family")
Cc: stable@vger.kernel.org # 2.6.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/em28xx/em28xx-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -89,7 +89,7 @@ int em28xx_read_reg_req_len(struct em28x
mutex_lock(&dev->ctrl_urb_lock);
ret = usb_control_msg(udev, pipe, req,
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- 0x0000, reg, dev->urb_buf, len, HZ);
+ 0x0000, reg, dev->urb_buf, len, 1000);
if (ret < 0) {
em28xx_regdbg("(pipe 0x%08x): IN: %02x %02x %02x %02x %02x %02x %02x %02x failed with error %i\n",
pipe,
@@ -158,7 +158,7 @@ int em28xx_write_regs_req(struct em28xx
memcpy(dev->urb_buf, buf, len);
ret = usb_control_msg(udev, pipe, req,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- 0x0000, reg, dev->urb_buf, len, HZ);
+ 0x0000, reg, dev->urb_buf, len, 1000);
mutex_unlock(&dev->ctrl_urb_lock);
if (ret < 0) {
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 046/846] media: cpia2: fix control-message timeouts
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 045/846] media: em28xx: " Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 047/846] media: s2255: " Greg Kroah-Hartman
` (803 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 10729be03327f53258cb196362015ad5c6eabe02 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support")
Cc: stable@vger.kernel.org # 2.6.17
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cpia2/cpia2_usb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -550,7 +550,7 @@ static int write_packet(struct usb_devic
0, /* index */
buf, /* buffer */
size,
- HZ);
+ 1000);
kfree(buf);
return ret;
@@ -582,7 +582,7 @@ static int read_packet(struct usb_device
0, /* index */
buf, /* buffer */
size,
- HZ);
+ 1000);
if (ret >= 0)
memcpy(registers, buf, size);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 047/846] media: s2255: fix control-message timeouts
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 046/846] media: cpia2: " Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 048/846] media: dib0700: fix undefined behavior in tuner shutdown Greg Kroah-Hartman
` (802 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit f71d272ad4e354097020a4e6b1dc6e4b59feb50f upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Use the common control-message timeout define for the five-second
timeouts.
Fixes: 38f993ad8b1f ("V4L/DVB (8125): This driver adds support for the Sensoray 2255 devices.")
Cc: stable@vger.kernel.org # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/s2255/s2255drv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -1882,7 +1882,7 @@ static long s2255_vendor_req(struct s225
USB_TYPE_VENDOR | USB_RECIP_DEVICE |
USB_DIR_IN,
Value, Index, buf,
- TransferBufferLength, HZ * 5);
+ TransferBufferLength, USB_CTRL_SET_TIMEOUT);
if (r >= 0)
memcpy(TransferBuffer, buf, TransferBufferLength);
@@ -1891,7 +1891,7 @@ static long s2255_vendor_req(struct s225
r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
Value, Index, buf,
- TransferBufferLength, HZ * 5);
+ TransferBufferLength, USB_CTRL_SET_TIMEOUT);
}
kfree(buf);
return r;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 048/846] media: dib0700: fix undefined behavior in tuner shutdown
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 047/846] media: s2255: " Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 049/846] media: redrat3: fix control-message timeouts Greg Kroah-Hartman
` (801 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Kuron, Mauro Carvalho Chehab
From: Michael Kuron <michael.kuron@gmail.com>
commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream.
This fixes a problem where closing the tuner would leave it in a state
where it would not tune to any channel when reopened. This problem was
discovered as part of https://github.com/hselasky/webcamd/issues/16.
Since adap->id is 0 or 1, this bit-shift overflows, which is undefined
behavior. The driver still worked in practice as the overflow would in
most environments result in 0, which rendered the line a no-op. When
running the driver as part of webcamd however, the overflow could lead
to 0xff due to optimizations by the compiler, which would, in the end,
improperly shut down the tuner.
The bug is a regression introduced in the commit referenced below. The
present patch causes identical behavior to before that commit for
adap->id equal to 0 or 1. The driver does not contain support for
dib0700 devices with more adapters, assuming such even exist.
Tests have been performed with the Xbox One Digital TV Tuner on amd64.
Not all dib0700 devices are expected to be affected by the regression;
this code path is only taken by those with incorrect endpoint numbers.
Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5bdd8201.1632689033.git.mchehab+huawei@kernel.org
Cc: stable@vger.kernel.org
Fixes: 7757ddda6f4f ("[media] DiB0700: add function to change I2C-speed")
Signed-off-by: Michael Kuron <michael.kuron@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/dib0700_core.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -618,8 +618,6 @@ int dib0700_streaming_ctrl(struct dvb_us
deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint);
if (onoff)
st->channel_state |= 1 << (adap->id);
- else
- st->channel_state |= 1 << ~(adap->id);
} else {
if (onoff)
st->channel_state |= 1 << (adap->fe_adap[0].stream.props.endpoint-2);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 049/846] media: redrat3: fix control-message timeouts
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 048/846] media: dib0700: fix undefined behavior in tuner shutdown Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 050/846] media: pvrusb2: " Greg Kroah-Hartman
` (800 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 2adc965c8bfa224e11ecccf9c92fd458c4236428 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Cc: stable@vger.kernel.org # 3.0
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/redrat3.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -404,7 +404,7 @@ static int redrat3_send_cmd(int cmd, str
udev = rr3->udev;
res = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), cmd,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- 0x0000, 0x0000, data, sizeof(u8), HZ * 10);
+ 0x0000, 0x0000, data, sizeof(u8), 10000);
if (res < 0) {
dev_err(rr3->dev, "%s: Error sending rr3 cmd res %d, data %d",
@@ -480,7 +480,7 @@ static u32 redrat3_get_timeout(struct re
pipe = usb_rcvctrlpipe(rr3->udev, 0);
ret = usb_control_msg(rr3->udev, pipe, RR3_GET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, HZ * 5);
+ RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, 5000);
if (ret != len)
dev_warn(rr3->dev, "Failed to read timeout from hardware\n");
else {
@@ -510,7 +510,7 @@ static int redrat3_set_timeout(struct rc
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
RR3_IR_IO_SIG_TIMEOUT, 0, timeout, sizeof(*timeout),
- HZ * 25);
+ 25000);
dev_dbg(dev, "set ir parm timeout %d ret 0x%02x\n",
be32_to_cpu(*timeout), ret);
@@ -542,32 +542,32 @@ static void redrat3_reset(struct redrat3
*val = 0x01;
rc = usb_control_msg(udev, rxpipe, RR3_RESET,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- RR3_CPUCS_REG_ADDR, 0, val, len, HZ * 25);
+ RR3_CPUCS_REG_ADDR, 0, val, len, 25000);
dev_dbg(dev, "reset returned 0x%02x\n", rc);
*val = length_fuzz;
rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- RR3_IR_IO_LENGTH_FUZZ, 0, val, len, HZ * 25);
+ RR3_IR_IO_LENGTH_FUZZ, 0, val, len, 25000);
dev_dbg(dev, "set ir parm len fuzz %d rc 0x%02x\n", *val, rc);
*val = (65536 - (minimum_pause * 2000)) / 256;
rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- RR3_IR_IO_MIN_PAUSE, 0, val, len, HZ * 25);
+ RR3_IR_IO_MIN_PAUSE, 0, val, len, 25000);
dev_dbg(dev, "set ir parm min pause %d rc 0x%02x\n", *val, rc);
*val = periods_measure_carrier;
rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- RR3_IR_IO_PERIODS_MF, 0, val, len, HZ * 25);
+ RR3_IR_IO_PERIODS_MF, 0, val, len, 25000);
dev_dbg(dev, "set ir parm periods measure carrier %d rc 0x%02x", *val,
rc);
*val = RR3_DRIVER_MAXLENS;
rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- RR3_IR_IO_MAX_LENGTHS, 0, val, len, HZ * 25);
+ RR3_IR_IO_MAX_LENGTHS, 0, val, len, 25000);
dev_dbg(dev, "set ir parm max lens %d rc 0x%02x\n", *val, rc);
kfree(val);
@@ -585,7 +585,7 @@ static void redrat3_get_firmware_rev(str
rc = usb_control_msg(rr3->udev, usb_rcvctrlpipe(rr3->udev, 0),
RR3_FW_VERSION,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- 0, 0, buffer, RR3_FW_VERSION_LEN, HZ * 5);
+ 0, 0, buffer, RR3_FW_VERSION_LEN, 5000);
if (rc >= 0)
dev_info(rr3->dev, "Firmware rev: %s", buffer);
@@ -825,14 +825,14 @@ static int redrat3_transmit_ir(struct rc
pipe = usb_sndbulkpipe(rr3->udev, rr3->ep_out->bEndpointAddress);
ret = usb_bulk_msg(rr3->udev, pipe, irdata,
- sendbuf_len, &ret_len, 10 * HZ);
+ sendbuf_len, &ret_len, 10000);
dev_dbg(dev, "sent %d bytes, (ret %d)\n", ret_len, ret);
/* now tell the hardware to transmit what we sent it */
pipe = usb_rcvctrlpipe(rr3->udev, 0);
ret = usb_control_msg(rr3->udev, pipe, RR3_TX_SEND_SIGNAL,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- 0, 0, irdata, 2, HZ * 10);
+ 0, 0, irdata, 2, 10000);
if (ret < 0)
dev_err(dev, "Error: control msg send failed, rc %d\n", ret);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 050/846] media: pvrusb2: fix control-message timeouts
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 049/846] media: redrat3: fix control-message timeouts Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 051/846] media: stk1160: " Greg Kroah-Hartman
` (799 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit b82bf9b9dc305d7d3d93eab106d70dbf2171b43e upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")
Cc: stable@vger.kernel.org # 2.6.18
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -1467,7 +1467,7 @@ static int pvr2_upload_firmware1(struct
for (address = 0; address < fwsize; address += 0x800) {
memcpy(fw_ptr, fw_entry->data + address, 0x800);
ret += usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address,
- 0, fw_ptr, 0x800, HZ);
+ 0, fw_ptr, 0x800, 1000);
}
trace_firmware("Upload done, releasing device's CPU");
@@ -1605,7 +1605,7 @@ int pvr2_upload_firmware2(struct pvr2_hd
((u32 *)fw_ptr)[icnt] = swab32(((u32 *)fw_ptr)[icnt]);
ret |= usb_bulk_msg(hdw->usb_dev, pipe, fw_ptr,bcnt,
- &actual_length, HZ);
+ &actual_length, 1000);
ret |= (actual_length != bcnt);
if (ret) break;
fw_done += bcnt;
@@ -3438,7 +3438,7 @@ void pvr2_hdw_cpufw_set_enabled(struct p
0xa0,0xc0,
address,0,
hdw->fw_buffer+address,
- 0x800,HZ);
+ 0x800,1000);
if (ret < 0) break;
}
@@ -3977,7 +3977,7 @@ void pvr2_hdw_cpureset_assert(struct pvr
/* Write the CPUCS register on the 8051. The lsb of the register
is the reset bit; a 1 asserts reset while a 0 clears it. */
pipe = usb_sndctrlpipe(hdw->usb_dev, 0);
- ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,HZ);
+ ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,1000);
if (ret < 0) {
pvr2_trace(PVR2_TRACE_ERROR_LEGS,
"cpureset_assert(%d) error=%d",val,ret);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 051/846] media: stk1160: fix control-message timeouts
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 050/846] media: pvrusb2: " Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 052/846] media: cec-pin: fix interrupt en/disable handling Greg Kroah-Hartman
` (798 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replacement)")
Cc: stable@vger.kernel.org # 3.7
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/stk1160/stk1160-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/stk1160/stk1160-core.c
+++ b/drivers/media/usb/stk1160/stk1160-core.c
@@ -65,7 +65,7 @@ int stk1160_read_reg(struct stk1160 *dev
return -ENOMEM;
ret = usb_control_msg(dev->udev, pipe, 0x00,
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- 0x00, reg, buf, sizeof(u8), HZ);
+ 0x00, reg, buf, sizeof(u8), 1000);
if (ret < 0) {
stk1160_err("read failed on reg 0x%x (%d)\n",
reg, ret);
@@ -85,7 +85,7 @@ int stk1160_write_reg(struct stk1160 *de
ret = usb_control_msg(dev->udev, pipe, 0x01,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- value, reg, NULL, 0, HZ);
+ value, reg, NULL, 0, 1000);
if (ret < 0) {
stk1160_err("write failed on reg 0x%x (%d)\n",
reg, ret);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 052/846] media: cec-pin: fix interrupt en/disable handling
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 051/846] media: stk1160: " Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 053/846] can: softing_cs: softingcs_probe(): fix memleak on registration failure Greg Kroah-Hartman
` (797 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
commit 713bdfa10b5957053811470d298def9537d9ff13 upstream.
The en/disable_irq() functions keep track of the 'depth': i.e. if
interrupts are disabled twice, then it needs to enable_irq() calls to
enable them again. The cec-pin framework didn't take this into accound
and could disable irqs multiple times, and it expected that a single
enable_irq() would enable them again.
Move all calls to en/disable_irq() to the kthread where it is easy
to keep track of the current irq state and ensure that multiple
en/disable_irq calls never happen.
If interrupts where disabled twice, then they would never turn on
again, leaving the CEC adapter in a dead state.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 865463fc03ed (media: cec-pin: add error injection support)
Cc: <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/core/cec-pin.c | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
--- a/drivers/media/cec/core/cec-pin.c
+++ b/drivers/media/cec/core/cec-pin.c
@@ -1033,6 +1033,7 @@ static int cec_pin_thread_func(void *_ad
{
struct cec_adapter *adap = _adap;
struct cec_pin *pin = adap->pin;
+ bool irq_enabled = false;
for (;;) {
wait_event_interruptible(pin->kthread_waitq,
@@ -1060,6 +1061,7 @@ static int cec_pin_thread_func(void *_ad
ns_to_ktime(pin->work_rx_msg.rx_ts));
msg->len = 0;
}
+
if (pin->work_tx_status) {
unsigned int tx_status = pin->work_tx_status;
@@ -1083,27 +1085,39 @@ static int cec_pin_thread_func(void *_ad
switch (atomic_xchg(&pin->work_irq_change,
CEC_PIN_IRQ_UNCHANGED)) {
case CEC_PIN_IRQ_DISABLE:
- pin->ops->disable_irq(adap);
+ if (irq_enabled) {
+ pin->ops->disable_irq(adap);
+ irq_enabled = false;
+ }
cec_pin_high(pin);
cec_pin_to_idle(pin);
hrtimer_start(&pin->timer, ns_to_ktime(0),
HRTIMER_MODE_REL);
break;
case CEC_PIN_IRQ_ENABLE:
+ if (irq_enabled)
+ break;
pin->enable_irq_failed = !pin->ops->enable_irq(adap);
if (pin->enable_irq_failed) {
cec_pin_to_idle(pin);
hrtimer_start(&pin->timer, ns_to_ktime(0),
HRTIMER_MODE_REL);
+ } else {
+ irq_enabled = true;
}
break;
default:
break;
}
-
if (kthread_should_stop())
break;
}
+ if (pin->ops->disable_irq && irq_enabled)
+ pin->ops->disable_irq(adap);
+ hrtimer_cancel(&pin->timer);
+ cec_pin_read(pin);
+ cec_pin_to_idle(pin);
+ pin->state = CEC_ST_OFF;
return 0;
}
@@ -1130,13 +1144,7 @@ static int cec_pin_adap_enable(struct ce
hrtimer_start(&pin->timer, ns_to_ktime(0),
HRTIMER_MODE_REL);
} else {
- if (pin->ops->disable_irq)
- pin->ops->disable_irq(adap);
- hrtimer_cancel(&pin->timer);
kthread_stop(pin->kthread);
- cec_pin_read(pin);
- cec_pin_to_idle(pin);
- pin->state = CEC_ST_OFF;
}
return 0;
}
@@ -1157,11 +1165,8 @@ void cec_pin_start_timer(struct cec_pin
if (pin->state != CEC_ST_RX_IRQ)
return;
- atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_UNCHANGED);
- pin->ops->disable_irq(pin->adap);
- cec_pin_high(pin);
- cec_pin_to_idle(pin);
- hrtimer_start(&pin->timer, ns_to_ktime(0), HRTIMER_MODE_REL);
+ atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_DISABLE);
+ wake_up_interruptible(&pin->kthread_waitq);
}
static int cec_pin_adap_transmit(struct cec_adapter *adap, u8 attempts,
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 053/846] can: softing_cs: softingcs_probe(): fix memleak on registration failure
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 052/846] media: cec-pin: fix interrupt en/disable handling Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 054/846] mei: hbm: fix client dma reply status Greg Kroah-Hartman
` (796 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Marc Kleine-Budde
From: Johan Hovold <johan@kernel.org>
commit ced4913efb0acc844ed65cc01d091a85d83a2082 upstream.
In case device registration fails during probe, the driver state and
the embedded platform device structure needs to be freed using
platform_device_put() to properly free all resources (e.g. the device
name).
Fixes: 0a0b7a5f7a04 ("can: add driver for Softing card")
Link: https://lore.kernel.org/all/20211222104843.6105-1-johan@kernel.org
Cc: stable@vger.kernel.org # 2.6.38
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/softing/softing_cs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/can/softing/softing_cs.c
+++ b/drivers/net/can/softing/softing_cs.c
@@ -293,7 +293,7 @@ static int softingcs_probe(struct pcmcia
return 0;
platform_failed:
- kfree(dev);
+ platform_device_put(pdev);
mem_failed:
pcmcia_bad:
pcmcia_failed:
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 054/846] mei: hbm: fix client dma reply status
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 053/846] can: softing_cs: softingcs_probe(): fix memleak on registration failure Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 055/846] iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs Greg Kroah-Hartman
` (795 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Emmanuel Grumbach, Tomas Winkler,
Alexander Usyskin
From: Alexander Usyskin <alexander.usyskin@intel.com>
commit 6b0b80ac103b2a40c72a47c301745fd1f4ef4697 upstream.
Don't blindly copy status value received from the firmware
into internal client status field,
It may be positive and ERR_PTR(ret) will translate it
into an invalid address and the caller will crash.
Put the error code into the client status on failure.
Fixes: 369aea845951 ("mei: implement client dma setup.")
Cc: <stable@vger.kernel.org> # v5.11+
Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Tested-by: : Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Acked-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20211228082047.378115-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/hbm.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -672,10 +672,14 @@ static void mei_hbm_cl_dma_map_res(struc
if (!cl)
return;
- dev_dbg(dev->dev, "cl dma map result = %d\n", res->status);
- cl->status = res->status;
- if (!cl->status)
+ if (res->status) {
+ dev_err(dev->dev, "cl dma map failed %d\n", res->status);
+ cl->status = -EFAULT;
+ } else {
+ dev_dbg(dev->dev, "cl dma map succeeded\n");
cl->dma_mapped = 1;
+ cl->status = 0;
+ }
wake_up(&cl->wait);
}
@@ -698,10 +702,14 @@ static void mei_hbm_cl_dma_unmap_res(str
if (!cl)
return;
- dev_dbg(dev->dev, "cl dma unmap result = %d\n", res->status);
- cl->status = res->status;
- if (!cl->status)
+ if (res->status) {
+ dev_err(dev->dev, "cl dma unmap failed %d\n", res->status);
+ cl->status = -EFAULT;
+ } else {
+ dev_dbg(dev->dev, "cl dma unmap succeeded\n");
cl->dma_mapped = 0;
+ cl->status = 0;
+ }
wake_up(&cl->wait);
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 055/846] iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 054/846] mei: hbm: fix client dma reply status Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 056/846] iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046 Greg Kroah-Hartman
` (794 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kunyang Fan, Jonathan Cameron,
Andy Shevchenko, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit c9791a94384af07592d29504004d2255dbaf8663 upstream.
Unfortuanately a non standards compliant ACPI ID is known to be
in the wild on some AAEON boards.
Partly revert the removal of these IDs so that ADC081C will again
work + add a comment to that affect for future reference.
Whilst here use generic firmware properties rather than the ACPI
specific handling previously found in this driver.
Reported-by: Kunyang Fan <Kunyang_Fan@aaeon.com.tw>
Fixes: c458b7ca3fd0 ("iio:adc:ti-adc081c: Drop ACPI ids that seem very unlikely to be official.")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Tested-by: Kunyang Fan <Kunyang_Fan@aaeon.com.tw> #UP-extremei11
Link: https://lore.kernel.org/r/20211205172728.2826512-1-jic23@kernel.org
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ti-adc081c.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
--- a/drivers/iio/adc/ti-adc081c.c
+++ b/drivers/iio/adc/ti-adc081c.c
@@ -19,6 +19,7 @@
#include <linux/i2c.h>
#include <linux/module.h>
#include <linux/mod_devicetable.h>
+#include <linux/property.h>
#include <linux/iio/iio.h>
#include <linux/iio/buffer.h>
@@ -156,13 +157,16 @@ static int adc081c_probe(struct i2c_clie
{
struct iio_dev *iio;
struct adc081c *adc;
- struct adcxx1c_model *model;
+ const struct adcxx1c_model *model;
int err;
if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_WORD_DATA))
return -EOPNOTSUPP;
- model = &adcxx1c_models[id->driver_data];
+ if (dev_fwnode(&client->dev))
+ model = device_get_match_data(&client->dev);
+ else
+ model = &adcxx1c_models[id->driver_data];
iio = devm_iio_device_alloc(&client->dev, sizeof(*adc));
if (!iio)
@@ -210,10 +214,17 @@ static const struct i2c_device_id adc081
};
MODULE_DEVICE_TABLE(i2c, adc081c_id);
+static const struct acpi_device_id adc081c_acpi_match[] = {
+ /* Used on some AAEON boards */
+ { "ADC081C", (kernel_ulong_t)&adcxx1c_models[ADC081C] },
+ { }
+};
+MODULE_DEVICE_TABLE(acpi, adc081c_acpi_match);
+
static const struct of_device_id adc081c_of_match[] = {
- { .compatible = "ti,adc081c" },
- { .compatible = "ti,adc101c" },
- { .compatible = "ti,adc121c" },
+ { .compatible = "ti,adc081c", .data = &adcxx1c_models[ADC081C] },
+ { .compatible = "ti,adc101c", .data = &adcxx1c_models[ADC101C] },
+ { .compatible = "ti,adc121c", .data = &adcxx1c_models[ADC121C] },
{ }
};
MODULE_DEVICE_TABLE(of, adc081c_of_match);
@@ -222,6 +233,7 @@ static struct i2c_driver adc081c_driver
.driver = {
.name = "adc081c",
.of_match_table = adc081c_of_match,
+ .acpi_match_table = adc081c_acpi_match,
},
.probe = adc081c_probe,
.id_table = adc081c_id,
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 056/846] iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 055/846] iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 057/846] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() Greg Kroah-Hartman
` (793 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Cameron,
Pengutronix Kernel Team, Dmitry Torokhov, Oleksij Rempel, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit 9020ef659885f2622cfb386cc229b6d618362895 upstream.
IIO triggers are software IRQ chips that split an incoming IRQ into
separate IRQs routed to all devices using the trigger.
When all consumers are done then a trigger callback reenable() is
called. There are a few circumstances under which this can happen
in atomic context.
1) A single user of the trigger that calls the iio_trigger_done()
function from interrupt context.
2) A race between disconnecting the last device from a trigger and
the trigger itself sucessfully being disabled.
To avoid a resulting scheduling whilst atomic, close this second corner
by using schedule_work() to ensure the reenable is not done in atomic
context.
Note that drivers must be careful to manage the interaction of
set_state() and reenable() callbacks to ensure appropriate reference
counting if they are relying on the same hardware controls.
Deliberately taking this the slow path rather than via a fixes tree
because the error has hard to hit and I would like it to soak for a while
before hitting a release kernel.
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211017172209.112387-1-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-trigger.c | 36 +++++++++++++++++++++++++++++++++++-
include/linux/iio/trigger.h | 2 ++
2 files changed, 37 insertions(+), 1 deletion(-)
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -162,6 +162,39 @@ static struct iio_trigger *iio_trigger_a
return trig;
}
+static void iio_reenable_work_fn(struct work_struct *work)
+{
+ struct iio_trigger *trig = container_of(work, struct iio_trigger,
+ reenable_work);
+
+ /*
+ * This 'might' occur after the trigger state is set to disabled -
+ * in that case the driver should skip reenabling.
+ */
+ trig->ops->reenable(trig);
+}
+
+/*
+ * In general, reenable callbacks may need to sleep and this path is
+ * not performance sensitive, so just queue up a work item
+ * to reneable the trigger for us.
+ *
+ * Races that can cause this.
+ * 1) A handler occurs entirely in interrupt context so the counter
+ * the final decrement is still in this interrupt.
+ * 2) The trigger has been removed, but one last interrupt gets through.
+ *
+ * For (1) we must call reenable, but not in atomic context.
+ * For (2) it should be safe to call reenanble, if drivers never blindly
+ * reenable after state is off.
+ */
+static void iio_trigger_notify_done_atomic(struct iio_trigger *trig)
+{
+ if (atomic_dec_and_test(&trig->use_count) && trig->ops &&
+ trig->ops->reenable)
+ schedule_work(&trig->reenable_work);
+}
+
void iio_trigger_poll(struct iio_trigger *trig)
{
int i;
@@ -173,7 +206,7 @@ void iio_trigger_poll(struct iio_trigger
if (trig->subirqs[i].enabled)
generic_handle_irq(trig->subirq_base + i);
else
- iio_trigger_notify_done(trig);
+ iio_trigger_notify_done_atomic(trig);
}
}
}
@@ -535,6 +568,7 @@ struct iio_trigger *viio_trigger_alloc(s
trig->dev.type = &iio_trig_type;
trig->dev.bus = &iio_bus_type;
device_initialize(&trig->dev);
+ INIT_WORK(&trig->reenable_work, iio_reenable_work_fn);
mutex_init(&trig->pool_lock);
trig->subirq_base = irq_alloc_descs(-1, 0,
--- a/include/linux/iio/trigger.h
+++ b/include/linux/iio/trigger.h
@@ -55,6 +55,7 @@ struct iio_trigger_ops {
* @attached_own_device:[INTERN] if we are using our own device as trigger,
* i.e. if we registered a poll function to the same
* device as the one providing the trigger.
+ * @reenable_work: [INTERN] work item used to ensure reenable can sleep.
**/
struct iio_trigger {
const struct iio_trigger_ops *ops;
@@ -74,6 +75,7 @@ struct iio_trigger {
unsigned long pool[BITS_TO_LONGS(CONFIG_IIO_CONSUMERS_PER_TRIGGER)];
struct mutex pool_lock;
bool attached_own_device;
+ struct work_struct reenable_work;
};
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 057/846] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 056/846] iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046 Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 058/846] bus: mhi: pci_generic: Graceful shutdown on freeze Greg Kroah-Hartman
` (792 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kees Cook, Arnd Bergmann,
Nick Desaulniers, Nathan Chancellor, Christophe Leroy
From: Christophe Leroy <christophe.leroy@csgroup.eu>
commit bc93a22a19eb2b68a16ecf04cdf4b2ed65aaf398 upstream.
On a kernel without CONFIG_STRICT_KERNEL_RWX, running EXEC_RODATA
test leads to "Illegal instruction" failure.
Looking at the content of rodata_objcopy.o, we see that the
function content zeroes only:
Disassembly of section .rodata:
0000000000000000 <.lkdtm_rodata_do_nothing>:
0: 00 00 00 00 .long 0x0
Add the contents flag in order to keep the content of the section
while renaming it.
Disassembly of section .rodata:
0000000000000000 <.lkdtm_rodata_do_nothing>:
0: 4e 80 00 20 blr
Fixes: e9e08a07385e ("lkdtm: support llvm-objcopy")
Cc: stable@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/8900731fbc05fb8b0de18af7133a8fc07c3c53a1.1633712176.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/lkdtm/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/misc/lkdtm/Makefile
+++ b/drivers/misc/lkdtm/Makefile
@@ -20,7 +20,7 @@ CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LT
OBJCOPYFLAGS :=
OBJCOPYFLAGS_rodata_objcopy.o := \
- --rename-section .noinstr.text=.rodata,alloc,readonly,load
+ --rename-section .noinstr.text=.rodata,alloc,readonly,load,contents
targets += rodata.o rodata_objcopy.o
$(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE
$(call if_changed,objcopy)
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 058/846] bus: mhi: pci_generic: Graceful shutdown on freeze
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 057/846] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 059/846] bus: mhi: core: Fix reading wake_capable channel configuration Greg Kroah-Hartman
` (791 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bhaumik Bhatt, Hemant Kumar,
Manivannan Sadhasivam, Loic Poulain, Manivannan Sadhasivam
From: Loic Poulain <loic.poulain@linaro.org>
commit f77097ec8c0141a4b5cf3722a246be0cb5677e29 upstream.
There is no reason for shutting down MHI ungracefully on freeze,
this causes the MHI host stack & device stack to not be aligned
anymore since the proper MHI reset sequence is not performed for
ungraceful shutdown.
Link: https://lore.kernel.org/r/1635268180-13699-1-git-send-email-loic.poulain@linaro.org
Fixes: 5f0c2ee1fe8d ("bus: mhi: pci-generic: Fix hibernation")
Cc: stable@vger.kernel.org
Suggested-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Reviewed-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20211216081227.237749-3-manivannan.sadhasivam@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/mhi/pci_generic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/bus/mhi/pci_generic.c
+++ b/drivers/bus/mhi/pci_generic.c
@@ -1018,7 +1018,7 @@ static int __maybe_unused mhi_pci_freeze
* context.
*/
if (test_and_clear_bit(MHI_PCI_DEV_STARTED, &mhi_pdev->status)) {
- mhi_power_down(mhi_cntrl, false);
+ mhi_power_down(mhi_cntrl, true);
mhi_unprepare_after_power_down(mhi_cntrl);
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 059/846] bus: mhi: core: Fix reading wake_capable channel configuration
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 058/846] bus: mhi: pci_generic: Graceful shutdown on freeze Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 060/846] bus: mhi: core: Fix race while handling SYS_ERR at power up Greg Kroah-Hartman
` (790 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Bhaumik Bhatt,
Manivannan Sadhasivam
From: Bhaumik Bhatt <quic_bbhatt@quicinc.com>
commit 42c4668f7efe1485dfc382517b412c0c6ab102b8 upstream.
The 'wake-capable' entry in channel configuration is not set when
parsing the configuration specified by the controller driver. Add
the missing entry to ensure channel is correctly specified as a
'wake-capable' channel.
Link: https://lore.kernel.org/r/1638320491-13382-1-git-send-email-quic_bbhatt@quicinc.com
Fixes: 0cbf260820fa ("bus: mhi: core: Add support for registering MHI controllers")
Cc: stable@vger.kernel.org
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bhaumik Bhatt <quic_bbhatt@quicinc.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20211216081227.237749-7-manivannan.sadhasivam@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/mhi/core/init.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/bus/mhi/core/init.c
+++ b/drivers/bus/mhi/core/init.c
@@ -788,6 +788,7 @@ static int parse_ch_cfg(struct mhi_contr
mhi_chan->offload_ch = ch_cfg->offload_channel;
mhi_chan->db_cfg.reset_req = ch_cfg->doorbell_mode_switch;
mhi_chan->pre_alloc = ch_cfg->auto_queue;
+ mhi_chan->wake_capable = ch_cfg->wake_capable;
/*
* If MHI host allocates buffers, then the channel direction
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 060/846] bus: mhi: core: Fix race while handling SYS_ERR at power up
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 059/846] bus: mhi: core: Fix reading wake_capable channel configuration Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 061/846] cxl/pmem: Fix reference counting for delayed work Greg Kroah-Hartman
` (789 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aleksander Morgado, Thomas Perrot,
Manivannan Sadhasivam
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
commit d651ce8e917fa1bf6cfab8dca74c512edffc35d3 upstream.
During SYS_ERR condition, as a response to the MHI_RESET from host, some
devices tend to issue BHI interrupt without clearing the SYS_ERR state in
the device. This creates a race condition and causes a failure in booting
up the device.
The issue is seen on the Sierra Wireless EM9191 modem during SYS_ERR
handling in mhi_async_power_up(). Once the host detects that the device
is in SYS_ERR state, it issues MHI_RESET and waits for the device to
process the reset request. During this time, the device triggers the BHI
interrupt to the host without clearing SYS_ERR condition. So the host
starts handling the SYS_ERR condition again.
To fix this issue, let's register the IRQ handler only after handling the
SYS_ERR check to avoid getting spurious IRQs from the device.
Fixes: e18d4e9fa79b ("bus: mhi: core: Handle syserr during power_up")
Cc: stable@vger.kernel.org
Reported-by: Aleksander Morgado <aleksander@aleksander.es>
Tested-by: Aleksander Morgado <aleksander@aleksander.es>
Tested-by: Thomas Perrot <thomas.perrot@bootlin.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20211216081227.237749-8-manivannan.sadhasivam@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/mhi/core/pm.c | 35 ++++++++++++-----------------------
1 file changed, 12 insertions(+), 23 deletions(-)
--- a/drivers/bus/mhi/core/pm.c
+++ b/drivers/bus/mhi/core/pm.c
@@ -1053,7 +1053,7 @@ int mhi_async_power_up(struct mhi_contro
enum mhi_ee_type current_ee;
enum dev_st_transition next_state;
struct device *dev = &mhi_cntrl->mhi_dev->dev;
- u32 val;
+ u32 interval_us = 25000; /* poll register field every 25 milliseconds */
int ret;
dev_info(dev, "Requested to power ON\n");
@@ -1070,10 +1070,6 @@ int mhi_async_power_up(struct mhi_contro
mutex_lock(&mhi_cntrl->pm_mutex);
mhi_cntrl->pm_state = MHI_PM_DISABLE;
- ret = mhi_init_irq_setup(mhi_cntrl);
- if (ret)
- goto error_setup_irq;
-
/* Setup BHI INTVEC */
write_lock_irq(&mhi_cntrl->pm_lock);
mhi_write_reg(mhi_cntrl, mhi_cntrl->bhi, BHI_INTVEC, 0);
@@ -1087,7 +1083,7 @@ int mhi_async_power_up(struct mhi_contro
dev_err(dev, "%s is not a valid EE for power on\n",
TO_MHI_EXEC_STR(current_ee));
ret = -EIO;
- goto error_async_power_up;
+ goto error_exit;
}
state = mhi_get_mhi_state(mhi_cntrl);
@@ -1096,20 +1092,12 @@ int mhi_async_power_up(struct mhi_contro
if (state == MHI_STATE_SYS_ERR) {
mhi_set_mhi_state(mhi_cntrl, MHI_STATE_RESET);
- ret = wait_event_timeout(mhi_cntrl->state_event,
- MHI_PM_IN_FATAL_STATE(mhi_cntrl->pm_state) ||
- mhi_read_reg_field(mhi_cntrl,
- mhi_cntrl->regs,
- MHICTRL,
- MHICTRL_RESET_MASK,
- MHICTRL_RESET_SHIFT,
- &val) ||
- !val,
- msecs_to_jiffies(mhi_cntrl->timeout_ms));
- if (!ret) {
- ret = -EIO;
+ ret = mhi_poll_reg_field(mhi_cntrl, mhi_cntrl->regs, MHICTRL,
+ MHICTRL_RESET_MASK, MHICTRL_RESET_SHIFT, 0,
+ interval_us);
+ if (ret) {
dev_info(dev, "Failed to reset MHI due to syserr state\n");
- goto error_async_power_up;
+ goto error_exit;
}
/*
@@ -1119,6 +1107,10 @@ int mhi_async_power_up(struct mhi_contro
mhi_write_reg(mhi_cntrl, mhi_cntrl->bhi, BHI_INTVEC, 0);
}
+ ret = mhi_init_irq_setup(mhi_cntrl);
+ if (ret)
+ goto error_exit;
+
/* Transition to next state */
next_state = MHI_IN_PBL(current_ee) ?
DEV_ST_TRANSITION_PBL : DEV_ST_TRANSITION_READY;
@@ -1131,10 +1123,7 @@ int mhi_async_power_up(struct mhi_contro
return 0;
-error_async_power_up:
- mhi_deinit_free_irq(mhi_cntrl);
-
-error_setup_irq:
+error_exit:
mhi_cntrl->pm_state = MHI_PM_DISABLE;
mutex_unlock(&mhi_cntrl->pm_mutex);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 061/846] cxl/pmem: Fix reference counting for delayed work
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 060/846] bus: mhi: core: Fix race while handling SYS_ERR at power up Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.15 062/846] arm64: errata: Fix exec handling in erratum 1418040 workaround Greg Kroah-Hartman
` (788 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Ben Widawsky, Dan Williams
From: Dan Williams <dan.j.williams@intel.com>
commit 08b9e0ab8af48895337192e683de44ab1e1b7427 upstream.
There is a potential race between queue_work() returning and the
queued-work running that could result in put_device() running before
get_device(). Introduce the cxl_nvdimm_bridge_state_work() helper that
takes the reference unconditionally, but drops it if no new work was
queued, to keep the references balanced.
Fixes: 8fdcb1704f61 ("cxl/pmem: Add initial infrastructure for pmem support")
Cc: <stable@vger.kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Ben Widawsky <ben.widawsky@intel.com>
Link: https://lore.kernel.org/r/163553734757.2509761.3305231863616785470.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cxl/pmem.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/cxl/pmem.c
+++ b/drivers/cxl/pmem.c
@@ -149,14 +149,24 @@ static void cxl_nvb_update_state(struct
put_device(&cxl_nvb->dev);
}
+static void cxl_nvdimm_bridge_state_work(struct cxl_nvdimm_bridge *cxl_nvb)
+{
+ /*
+ * Take a reference that the workqueue will drop if new work
+ * gets queued.
+ */
+ get_device(&cxl_nvb->dev);
+ if (!queue_work(cxl_pmem_wq, &cxl_nvb->state_work))
+ put_device(&cxl_nvb->dev);
+}
+
static void cxl_nvdimm_bridge_remove(struct device *dev)
{
struct cxl_nvdimm_bridge *cxl_nvb = to_cxl_nvdimm_bridge(dev);
if (cxl_nvb->state == CXL_NVB_ONLINE)
cxl_nvb->state = CXL_NVB_OFFLINE;
- if (queue_work(cxl_pmem_wq, &cxl_nvb->state_work))
- get_device(&cxl_nvb->dev);
+ cxl_nvdimm_bridge_state_work(cxl_nvb);
}
static int cxl_nvdimm_bridge_probe(struct device *dev)
@@ -177,8 +187,7 @@ static int cxl_nvdimm_bridge_probe(struc
}
cxl_nvb->state = CXL_NVB_ONLINE;
- if (queue_work(cxl_pmem_wq, &cxl_nvb->state_work))
- get_device(&cxl_nvb->dev);
+ cxl_nvdimm_bridge_state_work(cxl_nvb);
return 0;
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 062/846] arm64: errata: Fix exec handling in erratum 1418040 workaround
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 061/846] cxl/pmem: Fix reference counting for delayed work Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 063/846] ARM: dts: at91: update alternate function of signal PD20 Greg Kroah-Hartman
` (787 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, D Scott Phillips, Marc Zyngier,
Catalin Marinas
From: D Scott Phillips <scott@os.amperecomputing.com>
commit 38e0257e0e6f4fef2aa2966b089b56a8b1cfb75c upstream.
The erratum 1418040 workaround enables CNTVCT_EL1 access trapping in EL0
when executing compat threads. The workaround is applied when switching
between tasks, but the need for the workaround could also change at an
exec(), when a non-compat task execs a compat binary or vice versa. Apply
the workaround in arch_setup_new_exec().
This leaves a small window of time between SET_PERSONALITY and
arch_setup_new_exec where preemption could occur and confuse the old
workaround logic that compares TIF_32BIT between prev and next. Instead, we
can just read cntkctl to make sure it's in the state that the next task
needs. I measured cntkctl read time to be about the same as a mov from a
general-purpose register on N1. Update the workaround logic to examine the
current value of cntkctl instead of the previous task's compat state.
Fixes: d49f7d7376d0 ("arm64: Move handling of erratum 1418040 into C code")
Cc: <stable@vger.kernel.org> # 5.9.x
Signed-off-by: D Scott Phillips <scott@os.amperecomputing.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211220234114.3926-1-scott@os.amperecomputing.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/process.c | 39 ++++++++++++++++-----------------------
1 file changed, 16 insertions(+), 23 deletions(-)
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -439,34 +439,26 @@ static void entry_task_switch(struct tas
/*
* ARM erratum 1418040 handling, affecting the 32bit view of CNTVCT.
- * Assuming the virtual counter is enabled at the beginning of times:
- *
- * - disable access when switching from a 64bit task to a 32bit task
- * - enable access when switching from a 32bit task to a 64bit task
+ * Ensure access is disabled when switching to a 32bit task, ensure
+ * access is enabled when switching to a 64bit task.
*/
-static void erratum_1418040_thread_switch(struct task_struct *prev,
- struct task_struct *next)
+static void erratum_1418040_thread_switch(struct task_struct *next)
{
- bool prev32, next32;
- u64 val;
-
- if (!IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040))
- return;
-
- prev32 = is_compat_thread(task_thread_info(prev));
- next32 = is_compat_thread(task_thread_info(next));
-
- if (prev32 == next32 || !this_cpu_has_cap(ARM64_WORKAROUND_1418040))
+ if (!IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040) ||
+ !this_cpu_has_cap(ARM64_WORKAROUND_1418040))
return;
- val = read_sysreg(cntkctl_el1);
-
- if (!next32)
- val |= ARCH_TIMER_USR_VCT_ACCESS_EN;
+ if (is_compat_thread(task_thread_info(next)))
+ sysreg_clear_set(cntkctl_el1, ARCH_TIMER_USR_VCT_ACCESS_EN, 0);
else
- val &= ~ARCH_TIMER_USR_VCT_ACCESS_EN;
+ sysreg_clear_set(cntkctl_el1, 0, ARCH_TIMER_USR_VCT_ACCESS_EN);
+}
- write_sysreg(val, cntkctl_el1);
+static void erratum_1418040_new_exec(void)
+{
+ preempt_disable();
+ erratum_1418040_thread_switch(current);
+ preempt_enable();
}
/*
@@ -501,7 +493,7 @@ __notrace_funcgraph struct task_struct *
contextidr_thread_switch(next);
entry_task_switch(next);
ssbs_thread_switch(next);
- erratum_1418040_thread_switch(prev, next);
+ erratum_1418040_thread_switch(next);
ptrauth_thread_switch_user(next);
/*
@@ -613,6 +605,7 @@ void arch_setup_new_exec(void)
current->mm->context.flags = mmflags;
ptrauth_thread_init_user();
mte_thread_init_user();
+ erratum_1418040_new_exec();
if (task_spec_ssb_noexec(current)) {
arch_prctl_spec_ctrl_set(current, PR_SPEC_STORE_BYPASS,
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 063/846] ARM: dts: at91: update alternate function of signal PD20
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.15 062/846] arm64: errata: Fix exec handling in erratum 1418040 workaround Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 064/846] iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure Greg Kroah-Hartman
` (786 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hari Prasath, Nicolas Ferre
From: Hari Prasath <Hari.PrasathGE@microchip.com>
commit 12f332d2dd3187472f595b678246adb10d886bd0 upstream.
The alternate function of PD20 is 4 as per the datasheet of
sama7g5 and not 5 as defined earlier.
Signed-off-by: Hari Prasath <Hari.PrasathGE@microchip.com>
Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek")
Cc: <stable@vger.kernel.org> # v5.15+
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20211208063553.19807-1-Hari.PrasathGE@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/sama7g5-pinfunc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/sama7g5-pinfunc.h
+++ b/arch/arm/boot/dts/sama7g5-pinfunc.h
@@ -765,7 +765,7 @@
#define PIN_PD20__PCK0 PINMUX_PIN(PIN_PD20, 1, 3)
#define PIN_PD20__FLEXCOM2_IO3 PINMUX_PIN(PIN_PD20, 2, 2)
#define PIN_PD20__PWMH3 PINMUX_PIN(PIN_PD20, 3, 4)
-#define PIN_PD20__CANTX4 PINMUX_PIN(PIN_PD20, 5, 2)
+#define PIN_PD20__CANTX4 PINMUX_PIN(PIN_PD20, 4, 2)
#define PIN_PD20__FLEXCOM5_IO0 PINMUX_PIN(PIN_PD20, 6, 5)
#define PIN_PD21 117
#define PIN_PD21__GPIO PINMUX_PIN(PIN_PD21, 0, 0)
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 064/846] iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 063/846] ARM: dts: at91: update alternate function of signal PD20 Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 065/846] gpu: host1x: Add back arm_iommu_detach_device() Greg Kroah-Hartman
` (785 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yunfei Wang, Robin Murphy, Will Deacon
From: Yunfei Wang <yf.wang@mediatek.com>
commit a556cfe4cabc6d79cbb7733f118bbb420b376fe6 upstream.
In __arm_v7s_alloc_table function:
iommu call kmem_cache_alloc to allocate page table, this function
allocate memory may fail, when kmem_cache_alloc fails to allocate
table, call virt_to_phys will be abnomal and return unexpected phys
and goto out_free, then call kmem_cache_free to release table will
trigger KE, __get_free_pages and free_pages have similar problem,
so add error handle for page table allocation failure.
Fixes: 29859aeb8a6e ("iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the PTE")
Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
Cc: <stable@vger.kernel.org> # 5.10.*
Acked-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20211207113315.29109-1-yf.wang@mediatek.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/io-pgtable-arm-v7s.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -246,13 +246,17 @@ static void *__arm_v7s_alloc_table(int l
__GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size));
else if (lvl == 2)
table = kmem_cache_zalloc(data->l2_tables, gfp);
+
+ if (!table)
+ return NULL;
+
phys = virt_to_phys(table);
if (phys != (arm_v7s_iopte)phys) {
/* Doesn't fit in PTE */
dev_err(dev, "Page table does not fit in PTE: %pa", &phys);
goto out_free;
}
- if (table && !cfg->coherent_walk) {
+ if (!cfg->coherent_walk) {
dma = dma_map_single(dev, table, size, DMA_TO_DEVICE);
if (dma_mapping_error(dev, dma))
goto out_free;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 065/846] gpu: host1x: Add back arm_iommu_detach_device()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 064/846] iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 066/846] drm/tegra: " Greg Kroah-Hartman
` (784 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding
From: Dmitry Osipenko <digetx@gmail.com>
commit d5185965c3b59073c4520bad7dd2adf725b9abba upstream.
Host1x DMA buffer isn't mapped properly when CONFIG_ARM_DMA_USE_IOMMU=y.
The memory management code of Host1x driver has a longstanding overhaul
overdue and it's not obvious where the problem is in this case. Hence
let's add back the old workaround which we already had sometime before.
It explicitly detaches Host1x device from the offending implicit IOMMU
domain. This fixes a completely broken Host1x DMA in case of ARM32
multiplatform kernel config.
Cc: stable@vger.kernel.org
Fixes: af1cbfb9bf0f ("gpu: host1x: Support DMA mapping of buffers")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/host1x/dev.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -18,6 +18,10 @@
#include <trace/events/host1x.h>
#undef CREATE_TRACE_POINTS
+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
+#include <asm/dma-iommu.h>
+#endif
+
#include "bus.h"
#include "channel.h"
#include "debug.h"
@@ -238,6 +242,17 @@ static struct iommu_domain *host1x_iommu
struct iommu_domain *domain = iommu_get_domain_for_dev(host->dev);
int err;
+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
+ if (host->dev->archdata.mapping) {
+ struct dma_iommu_mapping *mapping =
+ to_dma_iommu_mapping(host->dev);
+ arm_iommu_detach_device(host->dev);
+ arm_iommu_release_mapping(mapping);
+
+ domain = iommu_get_domain_for_dev(host->dev);
+ }
+#endif
+
/*
* We may not always want to enable IOMMU support (for example if the
* host1x firewall is already enabled and we don't support addressing
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 066/846] drm/tegra: Add back arm_iommu_detach_device()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 065/846] gpu: host1x: Add back arm_iommu_detach_device() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 067/846] virtio/virtio_mem: handle a possible NULL as a memcpy parameter Greg Kroah-Hartman
` (783 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding
From: Dmitry Osipenko <digetx@gmail.com>
commit d210919dbdc8a82c676cc3e3c370b1802be63124 upstream.
DMA buffers of 2D/3D engines aren't mapped properly when
CONFIG_ARM_DMA_USE_IOMMU=y. The memory management code of Tegra DRM driver
has a longstanding overhaul overdue and it's not obvious where the problem
is in this case. Hence let's add back the old workaround which we already
had sometime before. It explicitly detaches DRM devices from the offending
implicit IOMMU domain. This fixes a completely broken 2d/3d drivers in
case of ARM32 multiplatform kernel config.
Cc: stable@vger.kernel.org
Fixes: fa6661b7aa0b ("drm/tegra: Optionally attach clients to the IOMMU")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/tegra/drm.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -21,6 +21,10 @@
#include <drm/drm_prime.h>
#include <drm/drm_vblank.h>
+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
+#include <asm/dma-iommu.h>
+#endif
+
#include "dc.h"
#include "drm.h"
#include "gem.h"
@@ -936,6 +940,17 @@ int host1x_client_iommu_attach(struct ho
struct iommu_group *group = NULL;
int err;
+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
+ if (client->dev->archdata.mapping) {
+ struct dma_iommu_mapping *mapping =
+ to_dma_iommu_mapping(client->dev);
+ arm_iommu_detach_device(client->dev);
+ arm_iommu_release_mapping(mapping);
+
+ domain = iommu_get_domain_for_dev(client->dev);
+ }
+#endif
+
/*
* If the host1x client is already attached to an IOMMU domain that is
* not the shared IOMMU domain, don't try to attach it to a different
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 067/846] virtio/virtio_mem: handle a possible NULL as a memcpy parameter
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 066/846] drm/tegra: " Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` Greg Kroah-Hartman
` (782 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peng Hao, Michael S. Tsirkin
From: Peng Hao <flyingpenghao@gmail.com>
commit cf4a4493ff70874f8af26d75d4346c591c298e89 upstream.
There is a check for vm->sbm.sb_states before, and it should check
it here as well.
Signed-off-by: Peng Hao <flyingpeng@tencent.com>
Link: https://lore.kernel.org/r/20211222011225.40573-1-flyingpeng@tencent.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Fixes: 5f1f79bbc9e2 ("virtio-mem: Paravirtualized memory hotplug")
Cc: stable@vger.kernel.org # v5.8+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio_mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/virtio/virtio_mem.c
+++ b/drivers/virtio/virtio_mem.c
@@ -577,7 +577,7 @@ static int virtio_mem_sbm_sb_states_prep
return -ENOMEM;
mutex_lock(&vm->hotplug_mutex);
- if (new_bitmap)
+ if (vm->sbm.sb_states)
memcpy(new_bitmap, vm->sbm.sb_states, old_pages * PAGE_SIZE);
old_bitmap = vm->sbm.sb_states;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 068/846] dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.15 002/846] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock Greg Kroah-Hartman
` (848 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Thomas Hellström, Gustavo Padovan, stable, linaro-mm-sig,
dri-devel, Greg Kroah-Hartman, Chris Wilson,
Christian König, linux-media
From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
commit 95d35838880fb040ccb9fe4a48816bd0c8b62df5 upstream.
If a dma_fence_array is reported signaled by a call to
dma_fence_is_signaled(), it may leak the PENDING_ERROR status.
Fix this by clearing the PENDING_ERROR status if we return true in
dma_fence_array_signaled().
v2:
- Update Cc list, and add R-b.
Fixes: 1f70b8b812f3 ("dma-fence: Propagate errors to dma-fence-array container")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: <stable@vger.kernel.org> # v5.4+
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211129152727.448908-1-thomas.hellstrom@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma-buf/dma-fence-array.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@@ -104,7 +104,11 @@ static bool dma_fence_array_signaled(str
{
struct dma_fence_array *array = to_dma_fence_array(fence);
- return atomic_read(&array->num_pending) <= 0;
+ if (atomic_read(&array->num_pending) > 0)
+ return false;
+
+ dma_fence_array_clear_pending_error(array);
+ return true;
}
static void dma_fence_array_release(struct dma_fence *fence)
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 068/846] dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
0 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Sumit Semwal,
Gustavo Padovan, Christian König, linux-media, dri-devel,
linaro-mm-sig, Thomas Hellström
From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
commit 95d35838880fb040ccb9fe4a48816bd0c8b62df5 upstream.
If a dma_fence_array is reported signaled by a call to
dma_fence_is_signaled(), it may leak the PENDING_ERROR status.
Fix this by clearing the PENDING_ERROR status if we return true in
dma_fence_array_signaled().
v2:
- Update Cc list, and add R-b.
Fixes: 1f70b8b812f3 ("dma-fence: Propagate errors to dma-fence-array container")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: <stable@vger.kernel.org> # v5.4+
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211129152727.448908-1-thomas.hellstrom@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma-buf/dma-fence-array.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@@ -104,7 +104,11 @@ static bool dma_fence_array_signaled(str
{
struct dma_fence_array *array = to_dma_fence_array(fence);
- return atomic_read(&array->num_pending) <= 0;
+ if (atomic_read(&array->num_pending) > 0)
+ return false;
+
+ dma_fence_array_clear_pending_error(array);
+ return true;
}
static void dma_fence_array_release(struct dma_fence *fence)
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 069/846] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2022-01-24 18:33 ` Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 070/846] mm_zone: add function to check if managed dma zone exists Greg Kroah-Hartman
` (780 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sam Bingner, Yifeng Li,
Bjorn Helgaas, Krzysztof Wilczyński
From: Yifeng Li <tomli@tomli.me>
commit e445375882883f69018aa669b67cbb37ec873406 upstream.
Like other SATA controller chips in the Marvell 88SE91xx series, the
Marvell 88SE9125 has the same DMA requester ID hardware bug that prevents
it from working under IOMMU. Add it to the list of devices that need the
quirk.
Without this patch, device initialization fails with DMA errors:
ata8: softreset failed (1st FIS failed)
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Write NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 [fault reason 0x02] Present bit in context entry is clear
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Read NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 [fault reason 0x02] Present bit in context entry is clear
After applying the patch, the controller can be successfully initialized:
ata8: SATA link up 1.5 Gbps (SStatus 113 SControl 330)
ata8.00: ATAPI: PIONEER BD-RW BDR-207M, 1.21, max UDMA/100
ata8.00: configured for UDMA/100
scsi 7:0:0:0: CD-ROM PIONEER BD-RW BDR-207M 1.21 PQ: 0 ANSI: 5
Link: https://lore.kernel.org/r/YahpKVR+McJVDdkD@work
Reported-by: Sam Bingner <sam@bingner.com>
Tested-by: Sam Bingner <sam@bingner.com>
Tested-by: Yifeng Li <tomli@tomli.me>
Signed-off-by: Yifeng Li <tomli@tomli.me>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Krzysztof Wilczyński <kw@linux.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4103,6 +4103,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_M
quirk_dma_func1_alias);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123,
quirk_dma_func1_alias);
+/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c136 */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125,
+ quirk_dma_func1_alias);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
quirk_dma_func1_alias);
/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 070/846] mm_zone: add function to check if managed dma zone exists
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 069/846] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 071/846] dma/pool: create dma atomic pool only if dma zone has managed pages Greg Kroah-Hartman
` (779 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Baoquan He, David Hildenbrand,
John Donnelly, Christoph Hellwig, Christoph Lameter,
Hyeonggon Yoo, Pekka Enberg, David Rientjes, Joonsoo Kim,
Vlastimil Babka, David Laight, Borislav Petkov, Marek Szyprowski,
Robin Murphy, Andrew Morton, Linus Torvalds
From: Baoquan He <bhe@redhat.com>
commit 62b3107073646e0946bd97ff926832bafb846d17 upstream.
Patch series "Handle warning of allocation failure on DMA zone w/o
managed pages", v4.
**Problem observed:
On x86_64, when crash is triggered and entering into kdump kernel, page
allocation failure can always be seen.
---------------------------------
DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
swapper/0: page allocation failure: order:5, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 1 Comm: swapper/0
Call Trace:
dump_stack+0x7f/0xa1
warn_alloc.cold+0x72/0xd6
......
__alloc_pages+0x24d/0x2c0
......
dma_atomic_pool_init+0xdb/0x176
do_one_initcall+0x67/0x320
? rcu_read_lock_sched_held+0x3f/0x80
kernel_init_freeable+0x290/0x2dc
? rest_init+0x24f/0x24f
kernel_init+0xa/0x111
ret_from_fork+0x22/0x30
Mem-Info:
------------------------------------
***Root cause:
In the current kernel, it assumes that DMA zone must have managed pages
and try to request pages if CONFIG_ZONE_DMA is enabled. While this is not
always true. E.g in kdump kernel of x86_64, only low 1M is presented and
locked down at very early stage of boot, so that this low 1M won't be
added into buddy allocator to become managed pages of DMA zone. This
exception will always cause page allocation failure if page is requested
from DMA zone.
***Investigation:
This failure happens since below commit merged into linus's tree.
1a6a9044b967 x86/setup: Remove CONFIG_X86_RESERVE_LOW and reservelow= options
23721c8e92f7 x86/crash: Remove crash_reserve_low_1M()
f1d4d47c5851 x86/setup: Always reserve the first 1M of RAM
7c321eb2b843 x86/kdump: Remove the backup region handling
6f599d84231f x86/kdump: Always reserve the low 1M when the crashkernel option is specified
Before them, on x86_64, the low 640K area will be reused by kdump kernel.
So in kdump kernel, the content of low 640K area is copied into a backup
region for dumping before jumping into kdump. Then except of those firmware
reserved region in [0, 640K], the left area will be added into buddy
allocator to become available managed pages of DMA zone.
However, after above commits applied, in kdump kernel of x86_64, the low
1M is reserved by memblock, but not released to buddy allocator. So any
later page allocation requested from DMA zone will fail.
At the beginning, if crashkernel is reserved, the low 1M need be locked
down because AMD SME encrypts memory making the old backup region
mechanims impossible when switching into kdump kernel.
Later, it was also observed that there are BIOSes corrupting memory
under 1M. To solve this, in commit f1d4d47c5851, the entire region of
low 1M is always reserved after the real mode trampoline is allocated.
Besides, recently, Intel engineer mentioned their TDX (Trusted domain
extensions) which is under development in kernel also needs to lock down
the low 1M. So we can't simply revert above commits to fix the page allocation
failure from DMA zone as someone suggested.
***Solution:
Currently, only DMA atomic pool and dma-kmalloc will initialize and
request page allocation with GFP_DMA during bootup.
So only initializ DMA atomic pool when DMA zone has available managed
pages, otherwise just skip the initialization.
For dma-kmalloc(), for the time being, let's mute the warning of
allocation failure if requesting pages from DMA zone while no manged
pages. Meanwhile, change code to use dma_alloc_xx/dma_map_xx API to
replace kmalloc(GFP_DMA), or do not use GFP_DMA when calling kmalloc() if
not necessary. Christoph is posting patches to fix those under
drivers/scsi/. Finally, we can remove the need of dma-kmalloc() as people
suggested.
This patch (of 3):
In some places of the current kernel, it assumes that dma zone must have
managed pages if CONFIG_ZONE_DMA is enabled. While this is not always
true. E.g in kdump kernel of x86_64, only low 1M is presented and locked
down at very early stage of boot, so that there's no managed pages at all
in DMA zone. This exception will always cause page allocation failure if
page is requested from DMA zone.
Here add function has_managed_dma() and the relevant helper functions to
check if there's DMA zone with managed pages. It will be used in later
patches.
Link: https://lkml.kernel.org/r/20211223094435.248523-1-bhe@redhat.com
Link: https://lkml.kernel.org/r/20211223094435.248523-2-bhe@redhat.com
Fixes: 6f599d84231f ("x86/kdump: Always reserve the low 1M when the crashkernel option is specified")
Signed-off-by: Baoquan He <bhe@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: John Donnelly <john.p.donnelly@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Christoph Lameter <cl@linux.com>
Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/mmzone.h | 9 +++++++++
mm/page_alloc.c | 15 +++++++++++++++
2 files changed, 24 insertions(+)
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -1031,6 +1031,15 @@ static inline int is_highmem_idx(enum zo
#endif
}
+#ifdef CONFIG_ZONE_DMA
+bool has_managed_dma(void);
+#else
+static inline bool has_managed_dma(void)
+{
+ return false;
+}
+#endif
+
/**
* is_highmem - helper function to quickly check if a struct zone is a
* highmem zone or not. This is an attempt to keep references
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -9449,3 +9449,18 @@ bool take_page_off_buddy(struct page *pa
return ret;
}
#endif
+
+#ifdef CONFIG_ZONE_DMA
+bool has_managed_dma(void)
+{
+ struct pglist_data *pgdat;
+
+ for_each_online_pgdat(pgdat) {
+ struct zone *zone = &pgdat->node_zones[ZONE_DMA];
+
+ if (managed_zone(zone))
+ return true;
+ }
+ return false;
+}
+#endif /* CONFIG_ZONE_DMA */
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 071/846] dma/pool: create dma atomic pool only if dma zone has managed pages
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 070/846] mm_zone: add function to check if managed dma zone exists Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 072/846] mm/page_alloc.c: do not warn allocation failure on zone DMA if no " Greg Kroah-Hartman
` (778 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Baoquan He, Christoph Hellwig,
John Donnelly, David Hildenbrand, Marek Szyprowski, Robin Murphy,
Borislav Petkov, Christoph Lameter, David Laight, David Rientjes,
Hyeonggon Yoo, Joonsoo Kim, Pekka Enberg, Vlastimil Babka,
Andrew Morton, Linus Torvalds
From: Baoquan He <bhe@redhat.com>
commit a674e48c5443d12a8a43c3ac42367aa39505d506 upstream.
Currently three dma atomic pools are initialized as long as the relevant
kernel codes are built in. While in kdump kernel of x86_64, this is not
right when trying to create atomic_pool_dma, because there's no managed
pages in DMA zone. In the case, DMA zone only has low 1M memory
presented and locked down by memblock allocator. So no pages are added
into buddy of DMA zone. Please check commit f1d4d47c5851 ("x86/setup:
Always reserve the first 1M of RAM").
Then in kdump kernel of x86_64, it always prints below failure message:
DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
swapper/0: page allocation failure: order:5, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-0.rc5.20210611git929d931f2b40.42.fc35.x86_64 #1
Hardware name: Dell Inc. PowerEdge R910/0P658H, BIOS 2.12.0 06/04/2018
Call Trace:
dump_stack+0x7f/0xa1
warn_alloc.cold+0x72/0xd6
__alloc_pages_slowpath.constprop.0+0xf29/0xf50
__alloc_pages+0x24d/0x2c0
alloc_page_interleave+0x13/0xb0
atomic_pool_expand+0x118/0x210
__dma_atomic_pool_init+0x45/0x93
dma_atomic_pool_init+0xdb/0x176
do_one_initcall+0x67/0x320
kernel_init_freeable+0x290/0x2dc
kernel_init+0xa/0x111
ret_from_fork+0x22/0x30
Mem-Info:
......
DMA: failed to allocate 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocation
DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
Here, let's check if DMA zone has managed pages, then create
atomic_pool_dma if yes. Otherwise just skip it.
Link: https://lkml.kernel.org/r/20211223094435.248523-3-bhe@redhat.com
Fixes: 6f599d84231f ("x86/kdump: Always reserve the low 1M when the crashkernel option is specified")
Signed-off-by: Baoquan He <bhe@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: John Donnelly <john.p.donnelly@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: David Rientjes <rientjes@google.com>
Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/dma/pool.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/dma/pool.c
+++ b/kernel/dma/pool.c
@@ -203,7 +203,7 @@ static int __init dma_atomic_pool_init(v
GFP_KERNEL);
if (!atomic_pool_kernel)
ret = -ENOMEM;
- if (IS_ENABLED(CONFIG_ZONE_DMA)) {
+ if (has_managed_dma()) {
atomic_pool_dma = __dma_atomic_pool_init(atomic_pool_size,
GFP_KERNEL | GFP_DMA);
if (!atomic_pool_dma)
@@ -226,7 +226,7 @@ static inline struct gen_pool *dma_guess
if (prev == NULL) {
if (IS_ENABLED(CONFIG_ZONE_DMA32) && (gfp & GFP_DMA32))
return atomic_pool_dma32;
- if (IS_ENABLED(CONFIG_ZONE_DMA) && (gfp & GFP_DMA))
+ if (atomic_pool_dma && (gfp & GFP_DMA))
return atomic_pool_dma;
return atomic_pool_kernel;
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 072/846] mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 071/846] dma/pool: create dma atomic pool only if dma zone has managed pages Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 073/846] ath11k: add string type to search board data in board-2.bin for WCN6855 Greg Kroah-Hartman
` (777 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Baoquan He, John Donnelly,
Hyeonggon Yoo, Christoph Lameter, Pekka Enberg, David Rientjes,
Joonsoo Kim, Vlastimil Babka, Borislav Petkov, Christoph Hellwig,
David Hildenbrand, David Laight, Marek Szyprowski, Robin Murphy,
Andrew Morton, Linus Torvalds
From: Baoquan He <bhe@redhat.com>
commit c4dc63f0032c77464fbd4e7a6afc22fa6913c4a7 upstream.
In kdump kernel of x86_64, page allocation failure is observed:
kworker/u2:2: page allocation failure: order:0, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 55 Comm: kworker/u2:2 Not tainted 5.16.0-rc4+ #5
Hardware name: AMD Dinar/Dinar, BIOS RDN1505B 06/05/2013
Workqueue: events_unbound async_run_entry_fn
Call Trace:
<TASK>
dump_stack_lvl+0x48/0x5e
warn_alloc.cold+0x72/0xd6
__alloc_pages_slowpath.constprop.0+0xc69/0xcd0
__alloc_pages+0x1df/0x210
new_slab+0x389/0x4d0
___slab_alloc+0x58f/0x770
__slab_alloc.constprop.0+0x4a/0x80
kmem_cache_alloc_trace+0x24b/0x2c0
sr_probe+0x1db/0x620
......
device_add+0x405/0x920
......
__scsi_add_device+0xe5/0x100
ata_scsi_scan_host+0x97/0x1d0
async_run_entry_fn+0x30/0x130
process_one_work+0x1e8/0x3c0
worker_thread+0x50/0x3b0
? rescuer_thread+0x350/0x350
kthread+0x16b/0x190
? set_kthread_struct+0x40/0x40
ret_from_fork+0x22/0x30
</TASK>
Mem-Info:
......
The above failure happened when calling kmalloc() to allocate buffer with
GFP_DMA. It requests to allocate slab page from DMA zone while no managed
pages at all in there.
sr_probe()
--> get_capabilities()
--> buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);
Because in the current kernel, dma-kmalloc will be created as long as
CONFIG_ZONE_DMA is enabled. However, kdump kernel of x86_64 doesn't have
managed pages on DMA zone since commit 6f599d84231f ("x86/kdump: Always
reserve the low 1M when the crashkernel option is specified"). The
failure can be always reproduced.
For now, let's mute the warning of allocation failure if requesting pages
from DMA zone while no managed pages.
[akpm@linux-foundation.org: fix warning]
Link: https://lkml.kernel.org/r/20211223094435.248523-4-bhe@redhat.com
Fixes: 6f599d84231f ("x86/kdump: Always reserve the low 1M when the crashkernel option is specified")
Signed-off-by: Baoquan He <bhe@redhat.com>
Acked-by: John Donnelly <john.p.donnelly@oracle.com>
Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Christoph Hellwig <hch@lst.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4210,7 +4210,9 @@ void warn_alloc(gfp_t gfp_mask, nodemask
va_list args;
static DEFINE_RATELIMIT_STATE(nopage_rs, 10*HZ, 1);
- if ((gfp_mask & __GFP_NOWARN) || !__ratelimit(&nopage_rs))
+ if ((gfp_mask & __GFP_NOWARN) ||
+ !__ratelimit(&nopage_rs) ||
+ ((gfp_mask & __GFP_DMA) && !has_managed_dma()))
return;
va_start(args, fmt);
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 073/846] ath11k: add string type to search board data in board-2.bin for WCN6855
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 072/846] mm/page_alloc.c: do not warn allocation failure on zone DMA if no " Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 074/846] shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Greg Kroah-Hartman
` (776 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wen Gong, Jouni Malinen, Kalle Valo,
Limonciello, Mario
From: Wen Gong <quic_wgong@quicinc.com>
commit fc95d10ac41d75c14a81afcc8722333d8b2cf80f upstream.
Currently ath11k only support string type with bus, chip id and board id
such as "bus=ahb,qmi-chip-id=1,qmi-board-id=4" for ahb bus chip and
"bus=pci,qmi-chip-id=0,qmi-board-id=255" for PCIe bus chip in
board-2.bin. For WCN6855, it is not enough to distinguish all different
chips.
This is to add a new string type which include bus, chip id, board id,
vendor, device, subsystem-vendor and subsystem-device for WCN6855.
ath11k will first load board-2.bin and search in it for the board data
with the above parameters, if matched one board data, then download it
to firmware, if not matched any one, then ath11k will download the file
board.bin to firmware.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211111065340.20187-1-quic_wgong@quicinc.com
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath11k/core.c | 27 +++++++++++++++++++++------
drivers/net/wireless/ath/ath11k/core.h | 13 +++++++++++++
drivers/net/wireless/ath/ath11k/pci.c | 10 ++++++++++
3 files changed, 44 insertions(+), 6 deletions(-)
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -347,11 +347,26 @@ static int ath11k_core_create_board_name
scnprintf(variant, sizeof(variant), ",variant=%s",
ab->qmi.target.bdf_ext);
- scnprintf(name, name_len,
- "bus=%s,qmi-chip-id=%d,qmi-board-id=%d%s",
- ath11k_bus_str(ab->hif.bus),
- ab->qmi.target.chip_id,
- ab->qmi.target.board_id, variant);
+ switch (ab->id.bdf_search) {
+ case ATH11K_BDF_SEARCH_BUS_AND_BOARD:
+ scnprintf(name, name_len,
+ "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s",
+ ath11k_bus_str(ab->hif.bus),
+ ab->id.vendor, ab->id.device,
+ ab->id.subsystem_vendor,
+ ab->id.subsystem_device,
+ ab->qmi.target.chip_id,
+ ab->qmi.target.board_id,
+ variant);
+ break;
+ default:
+ scnprintf(name, name_len,
+ "bus=%s,qmi-chip-id=%d,qmi-board-id=%d%s",
+ ath11k_bus_str(ab->hif.bus),
+ ab->qmi.target.chip_id,
+ ab->qmi.target.board_id, variant);
+ break;
+ }
ath11k_dbg(ab, ATH11K_DBG_BOOT, "boot using board name '%s'\n", name);
@@ -588,7 +603,7 @@ static int ath11k_core_fetch_board_data_
return 0;
}
-#define BOARD_NAME_SIZE 100
+#define BOARD_NAME_SIZE 200
int ath11k_core_fetch_bdf(struct ath11k_base *ab, struct ath11k_board_data *bd)
{
char boardname[BOARD_NAME_SIZE];
--- a/drivers/net/wireless/ath/ath11k/core.h
+++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -47,6 +47,11 @@ enum ath11k_supported_bw {
ATH11K_BW_160 = 3,
};
+enum ath11k_bdf_search {
+ ATH11K_BDF_SEARCH_DEFAULT,
+ ATH11K_BDF_SEARCH_BUS_AND_BOARD,
+};
+
enum wme_ac {
WME_AC_BE,
WME_AC_BK,
@@ -747,6 +752,14 @@ struct ath11k_base {
struct completion htc_suspend;
+ struct {
+ enum ath11k_bdf_search bdf_search;
+ u32 vendor;
+ u32 device;
+ u32 subsystem_vendor;
+ u32 subsystem_device;
+ } id;
+
/* must be last */
u8 drv_priv[0] __aligned(sizeof(void *));
};
--- a/drivers/net/wireless/ath/ath11k/pci.c
+++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -1218,6 +1218,15 @@ static int ath11k_pci_probe(struct pci_d
goto err_free_core;
}
+ ath11k_dbg(ab, ATH11K_DBG_BOOT, "pci probe %04x:%04x %04x:%04x\n",
+ pdev->vendor, pdev->device,
+ pdev->subsystem_vendor, pdev->subsystem_device);
+
+ ab->id.vendor = pdev->vendor;
+ ab->id.device = pdev->device;
+ ab->id.subsystem_vendor = pdev->subsystem_vendor;
+ ab->id.subsystem_device = pdev->subsystem_device;
+
switch (pci_dev->device) {
case QCA6390_DEVICE_ID:
ath11k_pci_read_hw_version(ab, &soc_hw_version_major,
@@ -1240,6 +1249,7 @@ static int ath11k_pci_probe(struct pci_d
ab->hw_rev = ATH11K_HW_QCN9074_HW10;
break;
case WCN6855_DEVICE_ID:
+ ab->id.bdf_search = ATH11K_BDF_SEARCH_BUS_AND_BOARD;
ath11k_pci_read_hw_version(ab, &soc_hw_version_major,
&soc_hw_version_minor);
switch (soc_hw_version_major) {
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 074/846] shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 073/846] ath11k: add string type to search board data in board-2.bin for WCN6855 Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 075/846] drm/ttm: Put BO in its memory managers lru list Greg Kroah-Hartman
` (775 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gang Li, Muchun Song,
Kirill A. Shutemov, Hugh Dickins, Andrew Morton, Linus Torvalds
From: Gang Li <ligang.bdlg@bytedance.com>
commit 62c9827cbb996c2c04f615ecd783ce28bcea894b upstream.
Fix a data race in commit 779750d20b93 ("shmem: split huge pages beyond
i_size under memory pressure").
Here are call traces causing race:
Call Trace 1:
shmem_unused_huge_shrink+0x3ae/0x410
? __list_lru_walk_one.isra.5+0x33/0x160
super_cache_scan+0x17c/0x190
shrink_slab.part.55+0x1ef/0x3f0
shrink_node+0x10e/0x330
kswapd+0x380/0x740
kthread+0xfc/0x130
? mem_cgroup_shrink_node+0x170/0x170
? kthread_create_on_node+0x70/0x70
ret_from_fork+0x1f/0x30
Call Trace 2:
shmem_evict_inode+0xd8/0x190
evict+0xbe/0x1c0
do_unlinkat+0x137/0x330
do_syscall_64+0x76/0x120
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
A simple explanation:
Image there are 3 items in the local list (@list). In the first
traversal, A is not deleted from @list.
1) A->B->C
^
|
pos (leave)
In the second traversal, B is deleted from @list. Concurrently, A is
deleted from @list through shmem_evict_inode() since last reference
counter of inode is dropped by other thread. Then the @list is corrupted.
2) A->B->C
^ ^
| |
evict pos (drop)
We should make sure the inode is either on the global list or deleted from
any local list before iput().
Fixed by moving inodes back to global list before we put them.
[akpm@linux-foundation.org: coding style fixes]
Link: https://lkml.kernel.org/r/20211125064502.99983-1-ligang.bdlg@bytedance.com
Fixes: 779750d20b93 ("shmem: split huge pages beyond i_size under memory pressure")
Signed-off-by: Gang Li <ligang.bdlg@bytedance.com>
Reviewed-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/shmem.c | 37 +++++++++++++++++++++----------------
1 file changed, 21 insertions(+), 16 deletions(-)
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -555,7 +555,7 @@ static unsigned long shmem_unused_huge_s
struct shmem_inode_info *info;
struct page *page;
unsigned long batch = sc ? sc->nr_to_scan : 128;
- int removed = 0, split = 0;
+ int split = 0;
if (list_empty(&sbinfo->shrinklist))
return SHRINK_STOP;
@@ -570,7 +570,6 @@ static unsigned long shmem_unused_huge_s
/* inode is about to be evicted */
if (!inode) {
list_del_init(&info->shrinklist);
- removed++;
goto next;
}
@@ -578,12 +577,12 @@ static unsigned long shmem_unused_huge_s
if (round_up(inode->i_size, PAGE_SIZE) ==
round_up(inode->i_size, HPAGE_PMD_SIZE)) {
list_move(&info->shrinklist, &to_remove);
- removed++;
goto next;
}
list_move(&info->shrinklist, &list);
next:
+ sbinfo->shrinklist_len--;
if (!--batch)
break;
}
@@ -603,7 +602,7 @@ next:
inode = &info->vfs_inode;
if (nr_to_split && split >= nr_to_split)
- goto leave;
+ goto move_back;
page = find_get_page(inode->i_mapping,
(inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT);
@@ -617,38 +616,44 @@ next:
}
/*
- * Leave the inode on the list if we failed to lock
- * the page at this time.
+ * Move the inode on the list back to shrinklist if we failed
+ * to lock the page at this time.
*
* Waiting for the lock may lead to deadlock in the
* reclaim path.
*/
if (!trylock_page(page)) {
put_page(page);
- goto leave;
+ goto move_back;
}
ret = split_huge_page(page);
unlock_page(page);
put_page(page);
- /* If split failed leave the inode on the list */
+ /* If split failed move the inode on the list back to shrinklist */
if (ret)
- goto leave;
+ goto move_back;
split++;
drop:
list_del_init(&info->shrinklist);
- removed++;
-leave:
+ goto put;
+move_back:
+ /*
+ * Make sure the inode is either on the global list or deleted
+ * from any local list before iput() since it could be deleted
+ * in another thread once we put the inode (then the local list
+ * is corrupted).
+ */
+ spin_lock(&sbinfo->shrinklist_lock);
+ list_move(&info->shrinklist, &sbinfo->shrinklist);
+ sbinfo->shrinklist_len++;
+ spin_unlock(&sbinfo->shrinklist_lock);
+put:
iput(inode);
}
- spin_lock(&sbinfo->shrinklist_lock);
- list_splice_tail(&list, &sbinfo->shrinklist);
- sbinfo->shrinklist_len -= removed;
- spin_unlock(&sbinfo->shrinklist_lock);
-
return split;
}
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 075/846] drm/ttm: Put BO in its memory managers lru list
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 074/846] shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 076/846] Bluetooth: L2CAP: Fix not initializing sk_peer_pid Greg Kroah-Hartman
` (774 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christian König, xinhui pan
From: xinhui pan <xinhui.pan@amd.com>
commit 781050b0a3164934857c300bb0bc291e38c26b6f upstream.
After we move BO to a new memory region, we should put it to
the new memory manager's lru list regardless we unlock the resv or not.
Cc: stable@vger.kernel.org
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: xinhui pan <xinhui.pan@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211110043149.57554-1-xinhui.pan@amd.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ttm/ttm_bo.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -724,6 +724,8 @@ int ttm_mem_evict_first(struct ttm_devic
ret = ttm_bo_evict(bo, ctx);
if (locked)
ttm_bo_unreserve(bo);
+ else
+ ttm_bo_move_to_lru_tail_unlocked(bo);
ttm_bo_put(bo);
return ret;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 076/846] Bluetooth: L2CAP: Fix not initializing sk_peer_pid
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 075/846] drm/ttm: Put BO in its memory managers lru list Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 077/846] drm/bridge: display-connector: fix an uninitialized pointer in probe() Greg Kroah-Hartman
` (773 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luiz Augusto von Dentz,
Marcel Holtmann, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit f5ff291098f70a70b344df1e388596755c3c8315 ]
In order to group sockets being connected using L2CAP_MODE_EXT_FLOWCTL
the pid is used but sk_peer_pid was not being initialized as it is
currently only done for af_unix.
Fixes: b48596d1dc25 ("Bluetooth: L2CAP: Add get_peer_pid callback")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_sock.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 160c016a5dfb9..4574c5cb1b596 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -172,6 +172,21 @@ done:
return err;
}
+static void l2cap_sock_init_pid(struct sock *sk)
+{
+ struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+ /* Only L2CAP_MODE_EXT_FLOWCTL ever need to access the PID in order to
+ * group the channels being requested.
+ */
+ if (chan->mode != L2CAP_MODE_EXT_FLOWCTL)
+ return;
+
+ spin_lock(&sk->sk_peer_lock);
+ sk->sk_peer_pid = get_pid(task_tgid(current));
+ spin_unlock(&sk->sk_peer_lock);
+}
+
static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
int alen, int flags)
{
@@ -243,6 +258,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
if (chan->psm && bdaddr_type_is_le(chan->src_type) && !chan->mode)
chan->mode = L2CAP_MODE_LE_FLOWCTL;
+ l2cap_sock_init_pid(sk);
+
err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
&la.l2_bdaddr, la.l2_bdaddr_type);
if (err)
@@ -298,6 +315,8 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
goto done;
}
+ l2cap_sock_init_pid(sk);
+
sk->sk_max_ack_backlog = backlog;
sk->sk_ack_backlog = 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 077/846] drm/bridge: display-connector: fix an uninitialized pointer in probe()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 076/846] Bluetooth: L2CAP: Fix not initializing sk_peer_pid Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 078/846] drm: fix null-ptr-deref in drm_dev_init_release() Greg Kroah-Hartman
` (772 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Sam Ravnborg, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 189723fbe9aca18d6f7d638c59a40288030932b5 ]
The "label" pointer is used for debug output. The code assumes that it
is either NULL or valid, but it is never set to NULL. It is either
valid or uninitialized.
Fixes: 0c275c30176b ("drm/bridge: Add bridge driver for display connectors")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211013080825.GE6010@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/display-connector.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
index 05eb759da6fc6..847a0dce7f1d3 100644
--- a/drivers/gpu/drm/bridge/display-connector.c
+++ b/drivers/gpu/drm/bridge/display-connector.c
@@ -107,7 +107,7 @@ static int display_connector_probe(struct platform_device *pdev)
{
struct display_connector *conn;
unsigned int type;
- const char *label;
+ const char *label = NULL;
int ret;
conn = devm_kzalloc(&pdev->dev, sizeof(*conn), GFP_KERNEL);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 078/846] drm: fix null-ptr-deref in drm_dev_init_release()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 077/846] drm/bridge: display-connector: fix an uninitialized pointer in probe() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 079/846] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure Greg Kroah-Hartman
` (771 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Sam Ravnborg,
Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit acf20ed020ffa4d6cc8347e8d356509b95df3cbe ]
I got a null-ptr-deref report:
[drm:drm_dev_init [drm]] *ERROR* Cannot allocate anonymous inode: -12
==================================================================
BUG: KASAN: null-ptr-deref in iput+0x3c/0x4a0
...
Call Trace:
dump_stack_lvl+0x6c/0x8b
kasan_report.cold+0x64/0xdb
__asan_load8+0x69/0x90
iput+0x3c/0x4a0
drm_dev_init_release+0x39/0xb0 [drm]
drm_managed_release+0x158/0x2d0 [drm]
drm_dev_init+0x3a7/0x4c0 [drm]
__devm_drm_dev_alloc+0x55/0xd0 [drm]
mi0283qt_probe+0x8a/0x2b5 [mi0283qt]
spi_probe+0xeb/0x130
...
entry_SYSCALL_64_after_hwframe+0x44/0xae
If drm_fs_inode_new() fails in drm_dev_init(), dev->anon_inode will point
to PTR_ERR(...) instead of NULL. This will result in null-ptr-deref when
drm_fs_inode_free(dev->anon_inode) is called.
drm_dev_init()
drm_fs_inode_new() // fail, dev->anon_inode = PTR_ERR(...)
drm_managed_release()
drm_dev_init_release()
drm_fs_inode_free() // access non-existent anon_inode
Define a temp variable and assign it to dev->anon_inode if the temp
variable is not PTR_ERR.
Fixes: 2cbf7fc6718b ("drm: Use drmm_ for drm_dev_init cleanup")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211013114139.4042207-1-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_drv.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 7a5097467ba5c..b3a1636d1b984 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -581,6 +581,7 @@ static int drm_dev_init(struct drm_device *dev,
const struct drm_driver *driver,
struct device *parent)
{
+ struct inode *inode;
int ret;
if (!drm_core_init_complete) {
@@ -617,13 +618,15 @@ static int drm_dev_init(struct drm_device *dev,
if (ret)
return ret;
- dev->anon_inode = drm_fs_inode_new();
- if (IS_ERR(dev->anon_inode)) {
- ret = PTR_ERR(dev->anon_inode);
+ inode = drm_fs_inode_new();
+ if (IS_ERR(inode)) {
+ ret = PTR_ERR(inode);
DRM_ERROR("Cannot allocate anonymous inode: %d\n", ret);
goto err;
}
+ dev->anon_inode = inode;
+
if (drm_core_check_feature(dev, DRIVER_RENDER)) {
ret = drm_minor_alloc(dev, DRM_MINOR_RENDER);
if (ret)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 079/846] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 078/846] drm: fix null-ptr-deref in drm_dev_init_release() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 080/846] drm/panel: innolux-p079zca: " Greg Kroah-Hartman
` (770 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Sam Ravnborg, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 5f31dbeae8a88f31c3eb4eb526ab4807c40da241 ]
If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't
ready), we leave a dangling drm_panel reference to freed memory. Clean
that up on failure.
Fixes: 2a994cbed6b2 ("drm/panel: Add Kingdisplay KD097D04 panel driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210923173336.1.Icb4d9dbc1817f4e826361a4f1cea7461541668f0@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
index 86e4213e8bb13..daccb1fd5fdad 100644
--- a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
+++ b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
@@ -406,7 +406,13 @@ static int kingdisplay_panel_probe(struct mipi_dsi_device *dsi)
if (err < 0)
return err;
- return mipi_dsi_attach(dsi);
+ err = mipi_dsi_attach(dsi);
+ if (err < 0) {
+ kingdisplay_panel_del(kingdisplay);
+ return err;
+ }
+
+ return 0;
}
static int kingdisplay_panel_remove(struct mipi_dsi_device *dsi)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 080/846] drm/panel: innolux-p079zca: Delete panel on attach() failure
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 079/846] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 081/846] drm/rockchip: dsi: Fix unbalanced clock on probe error Greg Kroah-Hartman
` (769 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Sam Ravnborg, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 32a267e9c057e1636e7afdd20599aa5741a73079 ]
If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't
ready), we leave a dangling drm_panel reference to freed memory. Clean
that up on failure.
This problem exists since the driver's introduction, but is especially
relevant after refactored for dual-DSI variants.
Fixes: 14c8f2e9f8ea ("drm/panel: add Innolux P079ZCA panel driver")
Fixes: 7ad4e4636c54 ("drm/panel: p079zca: Refactor panel driver to support multiple panels")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210923173336.2.I9023cf8811a3abf4964ed84eb681721d8bb489d6@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
index aea3162253914..f194b62e290ca 100644
--- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c
+++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
@@ -484,6 +484,7 @@ static void innolux_panel_del(struct innolux_panel *innolux)
static int innolux_panel_probe(struct mipi_dsi_device *dsi)
{
const struct panel_desc *desc;
+ struct innolux_panel *innolux;
int err;
desc = of_device_get_match_data(&dsi->dev);
@@ -495,7 +496,14 @@ static int innolux_panel_probe(struct mipi_dsi_device *dsi)
if (err < 0)
return err;
- return mipi_dsi_attach(dsi);
+ err = mipi_dsi_attach(dsi);
+ if (err < 0) {
+ innolux = mipi_dsi_get_drvdata(dsi);
+ innolux_panel_del(innolux);
+ return err;
+ }
+
+ return 0;
}
static int innolux_panel_remove(struct mipi_dsi_device *dsi)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 081/846] drm/rockchip: dsi: Fix unbalanced clock on probe error
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 080/846] drm/panel: innolux-p079zca: " Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 082/846] drm/rockchip: dsi: Hold pm-runtime across bind/unbind Greg Kroah-Hartman
` (768 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Chen-Yu Tsai,
Nícolas F . R . A . Prado, Heiko Stuebner, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 251888398753924059f3bb247a44153a2853137f ]
Our probe() function never enabled this clock, so we shouldn't disable
it if we fail to probe the bridge.
Noted by inspection.
Fixes: 2d4f7bdafd70 ("drm/rockchip: dsi: migrate to use dw-mipi-dsi bridge driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.3.Ie8ceefb51ab6065a1151869b6fcda41a467d4d2c@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
index a2262bee5aa47..b7eaffafbccbc 100644
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -1397,14 +1397,10 @@ static int dw_mipi_dsi_rockchip_probe(struct platform_device *pdev)
if (ret != -EPROBE_DEFER)
DRM_DEV_ERROR(dev,
"Failed to probe dw_mipi_dsi: %d\n", ret);
- goto err_clkdisable;
+ return ret;
}
return 0;
-
-err_clkdisable:
- clk_disable_unprepare(dsi->pllref_clk);
- return ret;
}
static int dw_mipi_dsi_rockchip_remove(struct platform_device *pdev)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 082/846] drm/rockchip: dsi: Hold pm-runtime across bind/unbind
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 081/846] drm/rockchip: dsi: Fix unbalanced clock on probe error Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 083/846] drm/rockchip: dsi: Disable PLL clock on bind error Greg Kroah-Hartman
` (767 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, aleksandr.o.makarov, Brian Norris,
Nícolas F . R . A . Prado, Chen-Yu Tsai, Heiko Stuebner
From: Brian Norris <briannorris@chromium.org>
commit 514db871922f103886ad4d221cf406b4fcc5e74a upstream.
In commit 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except
LCDC mux to bind()"), we moved most HW configuration to bind(), but we
didn't move the runtime PM management. Therefore, depending on initial
boot state, runtime-PM workqueue delays, and other timing factors, we
may disable our power domain in between the hardware configuration
(bind()) and when we enable the display. This can cause us to lose
hardware state and fail to configure our display. For example:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO
panel-innolux-p079zca ff960000.mipi.0: failed to write command 0
or:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO
panel-kingdisplay-kd097d04 ff960000.mipi.0: failed write init cmds: -110
We should match the runtime PM to the lifetime of the bind()/unbind()
cycle.
Tested on Acer Chrometab 10 (RK3399 Gru-Scarlet), with panel drivers
built either as modules or built-in.
Side notes: it seems one is more likely to see this problem when the
panel driver is built into the kernel. I've also seen this problem
bisect down to commits that simply changed Kconfig dependencies, because
it changed the order in which driver init functions were compiled into
the kernel, and therefore the ordering and timing of built-in device
probe.
Fixes: 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except LCDC mux to bind()")
Link: https://lore.kernel.org/linux-rockchip/9aedfb528600ecf871885f7293ca4207c84d16c1.camel@gmail.com/
Reported-by: <aleksandr.o.makarov@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.1.Ic2904d37f30013a7f3d8476203ad3733c186827e@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 37 ++++++++++++------------
1 file changed, 19 insertions(+), 18 deletions(-)
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -773,10 +773,6 @@ static void dw_mipi_dsi_encoder_enable(s
if (mux < 0)
return;
- pm_runtime_get_sync(dsi->dev);
- if (dsi->slave)
- pm_runtime_get_sync(dsi->slave->dev);
-
/*
* For the RK3399, the clk of grf must be enabled before writing grf
* register. And for RK3288 or other soc, this grf_clk must be NULL,
@@ -795,20 +791,10 @@ static void dw_mipi_dsi_encoder_enable(s
clk_disable_unprepare(dsi->grf_clk);
}
-static void dw_mipi_dsi_encoder_disable(struct drm_encoder *encoder)
-{
- struct dw_mipi_dsi_rockchip *dsi = to_dsi(encoder);
-
- if (dsi->slave)
- pm_runtime_put(dsi->slave->dev);
- pm_runtime_put(dsi->dev);
-}
-
static const struct drm_encoder_helper_funcs
dw_mipi_dsi_encoder_helper_funcs = {
.atomic_check = dw_mipi_dsi_encoder_atomic_check,
.enable = dw_mipi_dsi_encoder_enable,
- .disable = dw_mipi_dsi_encoder_disable,
};
static int rockchip_dsi_drm_create_encoder(struct dw_mipi_dsi_rockchip *dsi,
@@ -938,10 +924,14 @@ static int dw_mipi_dsi_rockchip_bind(str
put_device(second);
}
+ pm_runtime_get_sync(dsi->dev);
+ if (dsi->slave)
+ pm_runtime_get_sync(dsi->slave->dev);
+
ret = clk_prepare_enable(dsi->pllref_clk);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to enable pllref_clk: %d\n", ret);
- return ret;
+ goto out_pm_runtime;
}
/*
@@ -953,7 +943,7 @@ static int dw_mipi_dsi_rockchip_bind(str
ret = clk_prepare_enable(dsi->grf_clk);
if (ret) {
DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret);
- return ret;
+ goto out_pm_runtime;
}
dw_mipi_dsi_rockchip_config(dsi);
@@ -965,16 +955,23 @@ static int dw_mipi_dsi_rockchip_bind(str
ret = rockchip_dsi_drm_create_encoder(dsi, drm_dev);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to create drm encoder\n");
- return ret;
+ goto out_pm_runtime;
}
ret = dw_mipi_dsi_bind(dsi->dmd, &dsi->encoder);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to bind: %d\n", ret);
- return ret;
+ goto out_pm_runtime;
}
return 0;
+
+out_pm_runtime:
+ pm_runtime_put(dsi->dev);
+ if (dsi->slave)
+ pm_runtime_put(dsi->slave->dev);
+
+ return ret;
}
static void dw_mipi_dsi_rockchip_unbind(struct device *dev,
@@ -989,6 +986,10 @@ static void dw_mipi_dsi_rockchip_unbind(
dw_mipi_dsi_unbind(dsi->dmd);
clk_disable_unprepare(dsi->pllref_clk);
+
+ pm_runtime_put(dsi->dev);
+ if (dsi->slave)
+ pm_runtime_put(dsi->slave->dev);
}
static const struct component_ops dw_mipi_dsi_rockchip_ops = {
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 083/846] drm/rockchip: dsi: Disable PLL clock on bind error
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 082/846] drm/rockchip: dsi: Hold pm-runtime across bind/unbind Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 084/846] drm/rockchip: dsi: Reconfigure hardware on resume() Greg Kroah-Hartman
` (766 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Chen-Yu Tsai,
Nícolas F . R . A . Prado, Heiko Stuebner, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 5a614570172e1c9f59035d259dd735acd4f1c01b ]
Fix some error handling here noticed in review of other changes.
Fixes: 2d4f7bdafd70 ("drm/rockchip: dsi: migrate to use dw-mipi-dsi bridge driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reported-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.4.I8bb7a91ecc411d56bc155763faa15f289d7fc074@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
index fa40801767191..0ed13d81fe606 100644
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -943,7 +943,7 @@ static int dw_mipi_dsi_rockchip_bind(struct device *dev,
ret = clk_prepare_enable(dsi->grf_clk);
if (ret) {
DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret);
- goto out_pm_runtime;
+ goto out_pll_clk;
}
dw_mipi_dsi_rockchip_config(dsi);
@@ -955,17 +955,19 @@ static int dw_mipi_dsi_rockchip_bind(struct device *dev,
ret = rockchip_dsi_drm_create_encoder(dsi, drm_dev);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to create drm encoder\n");
- goto out_pm_runtime;
+ goto out_pll_clk;
}
ret = dw_mipi_dsi_bind(dsi->dmd, &dsi->encoder);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to bind: %d\n", ret);
- goto out_pm_runtime;
+ goto out_pll_clk;
}
return 0;
+out_pll_clk:
+ clk_disable_unprepare(dsi->pllref_clk);
out_pm_runtime:
pm_runtime_put(dsi->dev);
if (dsi->slave)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 084/846] drm/rockchip: dsi: Reconfigure hardware on resume()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 083/846] drm/rockchip: dsi: Disable PLL clock on bind error Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 085/846] Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle() Greg Kroah-Hartman
` (765 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Chen-Yu Tsai,
Nícolas F . R . A . Prado, Heiko Stuebner
From: Brian Norris <briannorris@chromium.org>
commit e584cdc1549932f87a2707b56bc588cfac5d89e0 upstream.
Since commit 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except
LCDC mux to bind()"), we perform most HW configuration in the bind()
function. This configuration may be lost on suspend/resume, so we
need to call it again. That may lead to errors like this after system
suspend/resume:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO
panel-kingdisplay-kd097d04 ff960000.mipi.0: failed write init cmds: -110
Tested on Acer Chromebook Tab 10 (RK3399 Gru-Scarlet).
Note that early mailing list versions of this driver borrowed Rockchip's
downstream/BSP solution, to do HW configuration in mode_set() (which
*is* called at the appropriate pre-enable() times), but that was
discarded along the way. I've avoided that still, because mode_set()
documentation doesn't suggest this kind of purpose as far as I can tell.
Fixes: 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except LCDC mux to bind()")
Cc: <stable@vger.kernel.org>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.2.I4e9d93aadb00b1ffc7d506e3186a25492bf0b732@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 37 ++++++++++++++++++++++++
1 file changed, 37 insertions(+)
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -268,6 +268,8 @@ struct dw_mipi_dsi_rockchip {
struct dw_mipi_dsi *dmd;
const struct rockchip_dw_dsi_chip_data *cdata;
struct dw_mipi_dsi_plat_data pdata;
+
+ bool dsi_bound;
};
struct dphy_pll_parameter_map {
@@ -964,6 +966,8 @@ static int dw_mipi_dsi_rockchip_bind(str
goto out_pll_clk;
}
+ dsi->dsi_bound = true;
+
return 0;
out_pll_clk:
@@ -985,6 +989,8 @@ static void dw_mipi_dsi_rockchip_unbind(
if (dsi->is_slave)
return;
+ dsi->dsi_bound = false;
+
dw_mipi_dsi_unbind(dsi->dmd);
clk_disable_unprepare(dsi->pllref_clk);
@@ -1279,6 +1285,36 @@ static const struct phy_ops dw_mipi_dsi_
.exit = dw_mipi_dsi_dphy_exit,
};
+static int __maybe_unused dw_mipi_dsi_rockchip_resume(struct device *dev)
+{
+ struct dw_mipi_dsi_rockchip *dsi = dev_get_drvdata(dev);
+ int ret;
+
+ /*
+ * Re-configure DSI state, if we were previously initialized. We need
+ * to do this before rockchip_drm_drv tries to re-enable() any panels.
+ */
+ if (dsi->dsi_bound) {
+ ret = clk_prepare_enable(dsi->grf_clk);
+ if (ret) {
+ DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret);
+ return ret;
+ }
+
+ dw_mipi_dsi_rockchip_config(dsi);
+ if (dsi->slave)
+ dw_mipi_dsi_rockchip_config(dsi->slave);
+
+ clk_disable_unprepare(dsi->grf_clk);
+ }
+
+ return 0;
+}
+
+static const struct dev_pm_ops dw_mipi_dsi_rockchip_pm_ops = {
+ SET_LATE_SYSTEM_SLEEP_PM_OPS(NULL, dw_mipi_dsi_rockchip_resume)
+};
+
static int dw_mipi_dsi_rockchip_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -1592,6 +1628,7 @@ struct platform_driver dw_mipi_dsi_rockc
.remove = dw_mipi_dsi_rockchip_remove,
.driver = {
.of_match_table = dw_mipi_dsi_rockchip_dt_ids,
+ .pm = &dw_mipi_dsi_rockchip_pm_ops,
.name = "dw-mipi-dsi-rockchip",
},
};
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 085/846] Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 084/846] drm/rockchip: dsi: Reconfigure hardware on resume() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 086/846] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Greg Kroah-Hartman
` (764 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Soenke Huster, Marcel Holtmann, Sasha Levin
From: Soenke Huster <soenke.huster@eknoes.de>
[ Upstream commit 1d0688421449718c6c5f46e458a378c9b530ba18 ]
On the reception of packets with an invalid packet type, the memory of
the allocated socket buffers is never freed. Add a default case that frees
these to avoid a memory leak.
Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: Soenke Huster <soenke.huster@eknoes.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/virtio_bt.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 57908ce4fae85..076e4942a3f0e 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -202,6 +202,9 @@ static void virtbt_rx_handle(struct virtio_bluetooth *vbt, struct sk_buff *skb)
hci_skb_pkt_type(skb) = pkt_type;
hci_recv_frame(vbt->hdev, skb);
break;
+ default:
+ kfree_skb(skb);
+ break;
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 086/846] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 085/846] Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 087/846] clk: bcm-2835: Pick the closest clock rate Greg Kroah-Hartman
` (763 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai,
Marcel Holtmann, Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ]
I got a kernel BUG report when doing fault injection test:
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:45!
...
RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d
...
Call Trace:
proto_unregister+0x83/0x220
cmtp_cleanup_sockets+0x37/0x40 [cmtp]
cmtp_exit+0xe/0x1f [cmtp]
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns
success. This will cause a kernel bug when accessing uncreated ctmp
related data when the module exits.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/cmtp/core.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 0a2d78e811cf5..83eb84e8e688f 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -501,9 +501,7 @@ static int __init cmtp_init(void)
{
BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
- cmtp_init_sockets();
-
- return 0;
+ return cmtp_init_sockets();
}
static void __exit cmtp_exit(void)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 087/846] clk: bcm-2835: Pick the closest clock rate
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 086/846] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 088/846] clk: bcm-2835: Remove rounding up the dividers Greg Kroah-Hartman
` (762 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Stephen Boyd,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 5517357a4733d7cf7c17fc79d0530cfa47add372 ]
The driver currently tries to pick the closest rate that is lower than
the rate being requested.
This causes an issue with clk_set_min_rate() since it actively checks
for the rounded rate to be above the minimum that was just set.
Let's change the logic a bit to pick the closest rate to the requested
rate, no matter if it's actually higher or lower.
Fixes: 6d18b8adbe67 ("clk: bcm2835: Support for clock parent selection")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Stephen Boyd <sboyd@kernel.org>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org> # boot and basic functionality
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-2-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/bcm/clk-bcm2835.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index a254512965eb8..bf97b2b2a63f8 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -1216,7 +1216,7 @@ static int bcm2835_clock_determine_rate(struct clk_hw *hw,
rate = bcm2835_clock_choose_div_and_prate(hw, i, req->rate,
&div, &prate,
&avgrate);
- if (rate > best_rate && rate <= req->rate) {
+ if (abs(req->rate - rate) < abs(req->rate - best_rate)) {
best_parent = parent;
best_prate = prate;
best_rate = rate;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 088/846] clk: bcm-2835: Remove rounding up the dividers
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 087/846] clk: bcm-2835: Pick the closest clock rate Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 089/846] drm/vc4: hdmi: Set a default HSM rate Greg Kroah-Hartman
` (761 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Stephen Boyd,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 8ca011ef4af48a7af7b15afd8a4a44039dd04cea ]
The driver, once it found a divider, tries to round it up by increasing
the least significant bit of the fractional part by one when the
round_up argument is set and there's a remainder.
However, since it increases the divider it will actually reduce the
clock rate below what we were asking for, leading to issues with
clk_set_min_rate() that will complain that our rounded clock rate is
below the minimum of the rate.
Since the dividers are fairly precise already, let's remove that part so
that we can have clk_set_min_rate() working.
This is effectively a revert of 9c95b32ca093 ("clk: bcm2835: add a round
up ability to the clock divisor").
Fixes: 9c95b32ca093 ("clk: bcm2835: add a round up ability to the clock divisor")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Stephen Boyd <sboyd@kernel.org>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org> # boot and basic functionality
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-3-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/bcm/clk-bcm2835.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index bf97b2b2a63f8..3667b4d731e71 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -932,8 +932,7 @@ static int bcm2835_clock_is_on(struct clk_hw *hw)
static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
unsigned long rate,
- unsigned long parent_rate,
- bool round_up)
+ unsigned long parent_rate)
{
struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
const struct bcm2835_clock_data *data = clock->data;
@@ -945,10 +944,6 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
rem = do_div(temp, rate);
div = temp;
-
- /* Round up and mask off the unused bits */
- if (round_up && ((div & unused_frac_mask) != 0 || rem != 0))
- div += unused_frac_mask + 1;
div &= ~unused_frac_mask;
/* different clamping limits apply for a mash clock */
@@ -1079,7 +1074,7 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
struct bcm2835_cprman *cprman = clock->cprman;
const struct bcm2835_clock_data *data = clock->data;
- u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate, false);
+ u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate);
u32 ctl;
spin_lock(&cprman->regs_lock);
@@ -1130,7 +1125,7 @@ static unsigned long bcm2835_clock_choose_div_and_prate(struct clk_hw *hw,
if (!(BIT(parent_idx) & data->set_rate_parent)) {
*prate = clk_hw_get_rate(parent);
- *div = bcm2835_clock_choose_div(hw, rate, *prate, true);
+ *div = bcm2835_clock_choose_div(hw, rate, *prate);
*avgrate = bcm2835_clock_rate_from_divisor(clock, *prate, *div);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 089/846] drm/vc4: hdmi: Set a default HSM rate
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 088/846] clk: bcm-2835: Remove rounding up the dividers Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 090/846] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm Greg Kroah-Hartman
` (760 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 3e85b81591609bb794bb00cd619b20965b5b38cd ]
When the firmware doesn't setup the HSM rate (such as when booting
without an HDMI cable plugged in), its rate is 0 and thus any register
access results in a CPU stall, even though HSM is enabled.
Let's enforce a minimum rate at boot to avoid this issue.
Fixes: 4f6e3d66ac52 ("drm/vc4: Add runtime PM support to the HDMI encoder driver")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-4-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index ed8a4b7f8b6e2..623a4699bd212 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -94,6 +94,7 @@
# define VC4_HD_M_SW_RST BIT(2)
# define VC4_HD_M_ENABLE BIT(0)
+#define HSM_MIN_CLOCK_FREQ 120000000
#define CEC_CLOCK_FREQ 40000
#define HDMI_14_MAX_TMDS_CLK (340 * 1000 * 1000)
@@ -2161,6 +2162,19 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
vc4_hdmi->disable_4kp60 = true;
}
+ /*
+ * If we boot without any cable connected to the HDMI connector,
+ * the firmware will skip the HSM initialization and leave it
+ * with a rate of 0, resulting in a bus lockup when we're
+ * accessing the registers even if it's enabled.
+ *
+ * Let's put a sensible default at runtime_resume so that we
+ * don't end up in this situation.
+ */
+ ret = clk_set_min_rate(vc4_hdmi->hsm_clock, HSM_MIN_CLOCK_FREQ);
+ if (ret)
+ goto err_put_ddc;
+
if (vc4_hdmi->variant->reset)
vc4_hdmi->variant->reset(vc4_hdmi);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 090/846] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 089/846] drm/vc4: hdmi: Set a default HSM rate Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 091/846] drm/vc4: hdmi: Make sure the controller is powered in detect Greg Kroah-Hartman
` (759 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Dave Stevenson,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit c86b41214362e8e715e1343e16d5d6af0562db05 ]
In order to access the HDMI controller, we need to make sure the HSM
clock is enabled. If we were to access it with the clock disabled, the
CPU would completely hang, resulting in an hard crash.
Since we have different code path that would require it, let's move that
clock enable / disable to runtime_pm that will take care of the
reference counting for us.
Since we also want to change the HSM clock rate and it's only valid
while the clock is disabled, we need to move the clk_set_min_rate() call
on the HSM clock above pm_runtime_get_and_sync().
Fixes: 4f6e3d66ac52 ("drm/vc4: Add runtime PM support to the HDMI encoder driver")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-5-maxime@cerno.tech
Link: https://lore.kernel.org/linux-arm-kernel/20210924152334.1342630-1-maxime@cerno.tech/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 70 +++++++++++++++++++++-------------
1 file changed, 44 insertions(+), 26 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 623a4699bd212..6b0700d0b408e 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -628,7 +628,6 @@ static void vc4_hdmi_encoder_post_crtc_powerdown(struct drm_encoder *encoder,
vc4_hdmi->variant->phy_disable(vc4_hdmi);
clk_disable_unprepare(vc4_hdmi->pixel_bvb_clock);
- clk_disable_unprepare(vc4_hdmi->hsm_clock);
clk_disable_unprepare(vc4_hdmi->pixel_clock);
ret = pm_runtime_put(&vc4_hdmi->pdev->dev);
@@ -894,28 +893,10 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
conn_state_to_vc4_hdmi_conn_state(conn_state);
struct drm_display_mode *mode = &encoder->crtc->state->adjusted_mode;
struct vc4_hdmi *vc4_hdmi = encoder_to_vc4_hdmi(encoder);
- unsigned long bvb_rate, pixel_rate, hsm_rate;
+ unsigned long pixel_rate = vc4_conn_state->pixel_rate;
+ unsigned long bvb_rate, hsm_rate;
int ret;
- ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
- if (ret < 0) {
- DRM_ERROR("Failed to retain power domain: %d\n", ret);
- return;
- }
-
- pixel_rate = vc4_conn_state->pixel_rate;
- ret = clk_set_rate(vc4_hdmi->pixel_clock, pixel_rate);
- if (ret) {
- DRM_ERROR("Failed to set pixel clock rate: %d\n", ret);
- return;
- }
-
- ret = clk_prepare_enable(vc4_hdmi->pixel_clock);
- if (ret) {
- DRM_ERROR("Failed to turn on pixel clock: %d\n", ret);
- return;
- }
-
/*
* As stated in RPi's vc4 firmware "HDMI state machine (HSM) clock must
* be faster than pixel clock, infinitesimally faster, tested in
@@ -939,10 +920,21 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
return;
}
- ret = clk_prepare_enable(vc4_hdmi->hsm_clock);
+ ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
+ if (ret < 0) {
+ DRM_ERROR("Failed to retain power domain: %d\n", ret);
+ return;
+ }
+
+ ret = clk_set_rate(vc4_hdmi->pixel_clock, pixel_rate);
if (ret) {
- DRM_ERROR("Failed to turn on HSM clock: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->pixel_clock);
+ DRM_ERROR("Failed to set pixel clock rate: %d\n", ret);
+ return;
+ }
+
+ ret = clk_prepare_enable(vc4_hdmi->pixel_clock);
+ if (ret) {
+ DRM_ERROR("Failed to turn on pixel clock: %d\n", ret);
return;
}
@@ -958,7 +950,6 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
ret = clk_set_min_rate(vc4_hdmi->pixel_bvb_clock, bvb_rate);
if (ret) {
DRM_ERROR("Failed to set pixel bvb clock rate: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->hsm_clock);
clk_disable_unprepare(vc4_hdmi->pixel_clock);
return;
}
@@ -966,7 +957,6 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
ret = clk_prepare_enable(vc4_hdmi->pixel_bvb_clock);
if (ret) {
DRM_ERROR("Failed to turn on pixel bvb clock: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->hsm_clock);
clk_disable_unprepare(vc4_hdmi->pixel_clock);
return;
}
@@ -2099,6 +2089,27 @@ static int vc5_hdmi_init_resources(struct vc4_hdmi *vc4_hdmi)
return 0;
}
+static int __maybe_unused vc4_hdmi_runtime_suspend(struct device *dev)
+{
+ struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+
+ clk_disable_unprepare(vc4_hdmi->hsm_clock);
+
+ return 0;
+}
+
+static int vc4_hdmi_runtime_resume(struct device *dev)
+{
+ struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+ int ret;
+
+ ret = clk_prepare_enable(vc4_hdmi->hsm_clock);
+ if (ret)
+ return ret;
+
+ return 0;
+}
+
static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
{
const struct vc4_hdmi_variant *variant = of_device_get_match_data(dev);
@@ -2366,11 +2377,18 @@ static const struct of_device_id vc4_hdmi_dt_match[] = {
{}
};
+static const struct dev_pm_ops vc4_hdmi_pm_ops = {
+ SET_RUNTIME_PM_OPS(vc4_hdmi_runtime_suspend,
+ vc4_hdmi_runtime_resume,
+ NULL)
+};
+
struct platform_driver vc4_hdmi_driver = {
.probe = vc4_hdmi_dev_probe,
.remove = vc4_hdmi_dev_remove,
.driver = {
.name = "vc4_hdmi",
.of_match_table = vc4_hdmi_dt_match,
+ .pm = &vc4_hdmi_pm_ops,
},
};
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 091/846] drm/vc4: hdmi: Make sure the controller is powered in detect
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 090/846] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 092/846] drm/vc4: hdmi: Make sure the controller is powered up during bind Greg Kroah-Hartman
` (758 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Dave Stevenson,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 0f5251339eda7f7eb7bd4467607ae1d01b24e129 ]
If the HPD GPIO is not available and drm_probe_ddc fails, we end up
reading the HDMI_HOTPLUG register, but the controller might be powered
off resulting in a CPU hang. Make sure we have the power domain and the
HSM clock powered during the detect cycle to prevent the hang from
happening.
Fixes: 4f6e3d66ac52 ("drm/vc4: Add runtime PM support to the HDMI encoder driver")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-6-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 6b0700d0b408e..21510ae31a9ec 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -168,6 +168,8 @@ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
bool connected = false;
+ WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev));
+
if (vc4_hdmi->hpd_gpio &&
gpiod_get_value_cansleep(vc4_hdmi->hpd_gpio)) {
connected = true;
@@ -188,10 +190,12 @@ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
}
}
+ pm_runtime_put(&vc4_hdmi->pdev->dev);
return connector_status_connected;
}
cec_phys_addr_invalidate(vc4_hdmi->cec_adap);
+ pm_runtime_put(&vc4_hdmi->pdev->dev);
return connector_status_disconnected;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 092/846] drm/vc4: hdmi: Make sure the controller is powered up during bind
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 091/846] drm/vc4: hdmi: Make sure the controller is powered in detect Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 093/846] drm/vc4: hdmi: Rework the pre_crtc_configure error handling Greg Kroah-Hartman
` (757 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Stevenson, Maxime Ripard, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 9c6e4f6ed1d61d5f46946e5c151ceb279eedadb1 ]
In the bind hook, we actually need the device to have the HSM clock
running during the final part of the display initialisation where we
reset the controller and initialise the CEC component.
Failing to do so will result in a complete, silent, hang of the CPU.
Fixes: 411efa18e4b0 ("drm/vc4: hdmi: Move the HSM clock enable to runtime_pm")
Link: https://patchwork.freedesktop.org/patch/msgid/20210819135931.895976-3-maxime@cerno.tech
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 21510ae31a9ec..2087717f1cce9 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -2190,6 +2190,18 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
if (ret)
goto err_put_ddc;
+ /*
+ * We need to have the device powered up at this point to call
+ * our reset hook and for the CEC init.
+ */
+ ret = vc4_hdmi_runtime_resume(dev);
+ if (ret)
+ goto err_put_ddc;
+
+ pm_runtime_get_noresume(dev);
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+
if (vc4_hdmi->variant->reset)
vc4_hdmi->variant->reset(vc4_hdmi);
@@ -2201,8 +2213,6 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
clk_prepare_enable(vc4_hdmi->pixel_bvb_clock);
}
- pm_runtime_enable(dev);
-
drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_TMDS);
drm_encoder_helper_add(encoder, &vc4_hdmi_encoder_helper_funcs);
@@ -2226,6 +2236,8 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
vc4_hdmi_debugfs_regs,
vc4_hdmi);
+ pm_runtime_put_sync(dev);
+
return 0;
err_free_cec:
@@ -2236,6 +2248,7 @@ err_destroy_conn:
vc4_hdmi_connector_destroy(&vc4_hdmi->connector);
err_destroy_encoder:
drm_encoder_cleanup(encoder);
+ pm_runtime_put_sync(dev);
pm_runtime_disable(dev);
err_put_ddc:
put_device(&vc4_hdmi->ddc->dev);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 093/846] drm/vc4: hdmi: Rework the pre_crtc_configure error handling
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 092/846] drm/vc4: hdmi: Make sure the controller is powered up during bind Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 094/846] drm/vc4: crtc: Make sure the HDMI controller is powered when disabling Greg Kroah-Hartman
` (756 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Stevenson, Maxime Ripard, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit caa51a4c11f1cadba9bcf61ed9e0105711952ce7 ]
Since our pre_crtc_configure hook returned void, we didn't implement a
goto-based error path handling, leading to errors like failing to put
back the device in pm_runtime in all the error paths, but also failing
to disable the pixel clock if clk_set_min_rate on the HSM clock fails.
Move to a goto-based implementation to have an easier consitency.
Fixes: 4f6e3d66ac52 ("drm/vc4: Add runtime PM support to the HDMI encoder driver")
Link: https://patchwork.freedesktop.org/patch/msgid/20210819135931.895976-4-maxime@cerno.tech
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 2087717f1cce9..49944644a9b36 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -933,15 +933,16 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
ret = clk_set_rate(vc4_hdmi->pixel_clock, pixel_rate);
if (ret) {
DRM_ERROR("Failed to set pixel clock rate: %d\n", ret);
- return;
+ goto err_put_runtime_pm;
}
ret = clk_prepare_enable(vc4_hdmi->pixel_clock);
if (ret) {
DRM_ERROR("Failed to turn on pixel clock: %d\n", ret);
- return;
+ goto err_put_runtime_pm;
}
+
vc4_hdmi_cec_update_clk_div(vc4_hdmi);
if (pixel_rate > 297000000)
@@ -954,15 +955,13 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
ret = clk_set_min_rate(vc4_hdmi->pixel_bvb_clock, bvb_rate);
if (ret) {
DRM_ERROR("Failed to set pixel bvb clock rate: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->pixel_clock);
- return;
+ goto err_disable_pixel_clock;
}
ret = clk_prepare_enable(vc4_hdmi->pixel_bvb_clock);
if (ret) {
DRM_ERROR("Failed to turn on pixel bvb clock: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->pixel_clock);
- return;
+ goto err_disable_pixel_clock;
}
if (vc4_hdmi->variant->phy_init)
@@ -975,6 +974,15 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
if (vc4_hdmi->variant->set_timings)
vc4_hdmi->variant->set_timings(vc4_hdmi, conn_state, mode);
+
+ return;
+
+err_disable_pixel_clock:
+ clk_disable_unprepare(vc4_hdmi->pixel_clock);
+err_put_runtime_pm:
+ pm_runtime_put(&vc4_hdmi->pdev->dev);
+
+ return;
}
static void vc4_hdmi_encoder_pre_crtc_enable(struct drm_encoder *encoder,
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 094/846] drm/vc4: crtc: Make sure the HDMI controller is powered when disabling
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 093/846] drm/vc4: hdmi: Rework the pre_crtc_configure error handling Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 095/846] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan Greg Kroah-Hartman
` (755 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard,
Nicolas Saenz Julienne, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit bca10db67bdaf15997a5a2a276e7aa9b6eea1393 ]
Since commit 875a4d536842 ("drm/vc4: drv: Disable the CRTC at boot
time"), during the initial setup of the driver we call into the VC4 HDMI
controller hooks to make sure the controller is properly disabled.
However, we were never making sure that the device was properly powered
while doing so. This never resulted in any (reported) issue in practice,
but since the introduction of commit 4209f03fcb8e ("drm/vc4: hdmi: Warn
if we access the controller while disabled") we get a loud complaint
when we do that kind of access.
Let's make sure we have the HDMI controller properly powered while
disabling it.
Fixes: 875a4d536842 ("drm/vc4: drv: Disable the CRTC at boot time")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210923185013.826679-1-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_crtc.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 18f5009ce90e3..c0df11e5fcf2b 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -32,6 +32,7 @@
#include <linux/clk.h>
#include <linux/component.h>
#include <linux/of_device.h>
+#include <linux/pm_runtime.h>
#include <drm/drm_atomic.h>
#include <drm/drm_atomic_helper.h>
@@ -42,6 +43,7 @@
#include <drm/drm_vblank.h>
#include "vc4_drv.h"
+#include "vc4_hdmi.h"
#include "vc4_regs.h"
#define HVS_FIFO_LATENCY_PIX 6
@@ -496,8 +498,10 @@ int vc4_crtc_disable_at_boot(struct drm_crtc *crtc)
enum vc4_encoder_type encoder_type;
const struct vc4_pv_data *pv_data;
struct drm_encoder *encoder;
+ struct vc4_hdmi *vc4_hdmi;
unsigned encoder_sel;
int channel;
+ int ret;
if (!(of_device_is_compatible(vc4_crtc->pdev->dev.of_node,
"brcm,bcm2711-pixelvalve2") ||
@@ -525,7 +529,20 @@ int vc4_crtc_disable_at_boot(struct drm_crtc *crtc)
if (WARN_ON(!encoder))
return 0;
- return vc4_crtc_disable(crtc, encoder, NULL, channel);
+ vc4_hdmi = encoder_to_vc4_hdmi(encoder);
+ ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
+ if (ret)
+ return ret;
+
+ ret = vc4_crtc_disable(crtc, encoder, NULL, channel);
+ if (ret)
+ return ret;
+
+ ret = pm_runtime_put(&vc4_hdmi->pdev->dev);
+ if (ret)
+ return ret;
+
+ return 0;
}
static void vc4_crtc_atomic_disable(struct drm_crtc *crtc,
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 095/846] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 094/846] drm/vc4: crtc: Make sure the HDMI controller is powered when disabling Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 096/846] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND Greg Kroah-Hartman
` (754 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Li, Bryan ODonoghue,
Kalle Valo, Sasha Levin
From: Benjamin Li <benl@squareup.com>
[ Upstream commit 8f1ba8b0ee2679f0b3d22d2a5c1bc70c436fd872 ]
An SMD capture from the downstream prima driver on WCN3680B shows the
following command sequence for connected scans:
- init_scan_req
- start_scan_req, channel 1
- end_scan_req, channel 1
- start_scan_req, channel 2
- ...
- end_scan_req, channel 3
- finish_scan_req
- init_scan_req
- start_scan_req, channel 4
- ...
- end_scan_req, channel 6
- finish_scan_req
- ...
- end_scan_req, channel 165
- finish_scan_req
Upstream currently never calls wcn36xx_smd_end_scan, and in some cases[1]
still sends finish_scan_req twice in a row or before init_scan_req. A
typical connected scan looks like this:
- init_scan_req
- start_scan_req, channel 1
- finish_scan_req
- init_scan_req
- start_scan_req, channel 2
- ...
- start_scan_req, channel 165
- finish_scan_req
- finish_scan_req
This patch cleans up scanning so that init/finish and start/end are always
paired together and correctly nested.
- init_scan_req
- start_scan_req, channel 1
- end_scan_req, channel 1
- finish_scan_req
- init_scan_req
- start_scan_req, channel 2
- end_scan_req, channel 2
- ...
- start_scan_req, channel 165
- end_scan_req, channel 165
- finish_scan_req
Note that upstream will not do batching of 3 active-probe scans before
returning to the operating channel, and this patch does not change that.
To match downstream in this aspect, adjust IEEE80211_PROBE_DELAY and/or
the 125ms max off-channel time in ieee80211_scan_state_decision.
[1]: commit d195d7aac09b ("wcn36xx: Ensure finish scan is not requested
before start scan") addressed one case of finish_scan_req being sent
without a preceding init_scan_req (the case of the operating channel
coinciding with the first scan channel); two other cases are:
1) if SW scan is started and aborted immediately, without scanning any
channels, we send a finish_scan_req without ever sending init_scan_req,
and
2) as SW scan logic always returns us to the operating channel before
calling wcn36xx_sw_scan_complete, finish_scan_req is always sent twice
at the end of a SW scan
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Benjamin Li <benl@squareup.com>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027170306.555535-4-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/main.c | 34 +++++++++++++++++-----
drivers/net/wireless/ath/wcn36xx/smd.c | 4 +++
drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 +
3 files changed, 32 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 5d82aca370a72..cf9e1396bd046 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -400,6 +400,7 @@ static void wcn36xx_change_opchannel(struct wcn36xx *wcn, int ch)
static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
{
struct wcn36xx *wcn = hw->priv;
+ int ret;
wcn36xx_dbg(WCN36XX_DBG_MAC, "mac config changed 0x%08x\n", changed);
@@ -415,17 +416,31 @@ static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
* want to receive/transmit regular data packets, then
* simply stop the scan session and exit PS mode.
*/
- wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN,
- wcn->sw_scan_vif);
- wcn->sw_scan_channel = 0;
+ if (wcn->sw_scan_channel)
+ wcn36xx_smd_end_scan(wcn, wcn->sw_scan_channel);
+ if (wcn->sw_scan_init) {
+ wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN,
+ wcn->sw_scan_vif);
+ }
} else if (wcn->sw_scan) {
/* A scan is ongoing, do not change the operating
* channel, but start a scan session on the channel.
*/
- wcn36xx_smd_init_scan(wcn, HAL_SYS_MODE_SCAN,
- wcn->sw_scan_vif);
+ if (wcn->sw_scan_channel)
+ wcn36xx_smd_end_scan(wcn, wcn->sw_scan_channel);
+ if (!wcn->sw_scan_init) {
+ /* This can fail if we are unable to notify the
+ * operating channel.
+ */
+ ret = wcn36xx_smd_init_scan(wcn,
+ HAL_SYS_MODE_SCAN,
+ wcn->sw_scan_vif);
+ if (ret) {
+ mutex_unlock(&wcn->conf_mutex);
+ return -EIO;
+ }
+ }
wcn36xx_smd_start_scan(wcn, ch);
- wcn->sw_scan_channel = ch;
} else {
wcn36xx_change_opchannel(wcn, ch);
}
@@ -713,7 +728,12 @@ static void wcn36xx_sw_scan_complete(struct ieee80211_hw *hw,
struct wcn36xx *wcn = hw->priv;
/* ensure that any scan session is finished */
- wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN, wcn->sw_scan_vif);
+ if (wcn->sw_scan_channel)
+ wcn36xx_smd_end_scan(wcn, wcn->sw_scan_channel);
+ if (wcn->sw_scan_init) {
+ wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN,
+ wcn->sw_scan_vif);
+ }
wcn->sw_scan = false;
wcn->sw_scan_opchannel = 0;
}
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 70bffe3d87a12..6ac770d8271eb 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -721,6 +721,7 @@ int wcn36xx_smd_init_scan(struct wcn36xx *wcn, enum wcn36xx_hal_sys_mode mode,
wcn36xx_err("hal_init_scan response failed err=%d\n", ret);
goto out;
}
+ wcn->sw_scan_init = true;
out:
mutex_unlock(&wcn->hal_mutex);
return ret;
@@ -751,6 +752,7 @@ int wcn36xx_smd_start_scan(struct wcn36xx *wcn, u8 scan_channel)
wcn36xx_err("hal_start_scan response failed err=%d\n", ret);
goto out;
}
+ wcn->sw_scan_channel = scan_channel;
out:
mutex_unlock(&wcn->hal_mutex);
return ret;
@@ -781,6 +783,7 @@ int wcn36xx_smd_end_scan(struct wcn36xx *wcn, u8 scan_channel)
wcn36xx_err("hal_end_scan response failed err=%d\n", ret);
goto out;
}
+ wcn->sw_scan_channel = 0;
out:
mutex_unlock(&wcn->hal_mutex);
return ret;
@@ -822,6 +825,7 @@ int wcn36xx_smd_finish_scan(struct wcn36xx *wcn,
wcn36xx_err("hal_finish_scan response failed err=%d\n", ret);
goto out;
}
+ wcn->sw_scan_init = false;
out:
mutex_unlock(&wcn->hal_mutex);
return ret;
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index e9560f35e9bcf..428546a6047f0 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -246,6 +246,7 @@ struct wcn36xx {
struct cfg80211_scan_request *scan_req;
bool sw_scan;
u8 sw_scan_opchannel;
+ bool sw_scan_init;
u8 sw_scan_channel;
struct ieee80211_vif *sw_scan_vif;
struct mutex scan_lock;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 096/846] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 095/846] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 097/846] drm/vc4: hdmi: Enable the scrambler on reconnection Greg Kroah-Hartman
` (753 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[ Upstream commit 588b45c88ae130fe373a8c50edaf54735c3f4fe3 ]
Firmware can trigger a missed beacon indication, this is not the same as a
lost signal.
Flag to Linux the missed beacon and let the WiFi stack decide for itself if
the link is up or down by sending its own probe to determine this.
We should only be signalling the link is lost when the firmware indicates
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027232529.657764-1-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/smd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 6ac770d8271eb..0ebef42feb695 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2679,7 +2679,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
tmp->bss_index);
vif = wcn36xx_priv_to_vif(tmp);
- ieee80211_connection_loss(vif);
+ ieee80211_beacon_loss(vif);
}
return 0;
}
@@ -2694,7 +2694,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
rsp->bss_index);
vif = wcn36xx_priv_to_vif(tmp);
- ieee80211_connection_loss(vif);
+ ieee80211_beacon_loss(vif);
return 0;
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 097/846] drm/vc4: hdmi: Enable the scrambler on reconnection
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 096/846] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 098/846] libbpf: Free up resources used by inner map definition Greg Kroah-Hartman
` (752 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Dave Stevenson, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit b7551457c5d0b3505b0be247d47919c1ee30506d ]
If we have a state already and disconnect/reconnect the display, the
SCDC messages won't be sent again since we didn't go through a disable /
enable cycle.
In order to fix this, let's call the vc4_hdmi_enable_scrambling function
in the detect callback if there is a mode and it needs the scrambler to
be enabled.
Fixes: c85695a2016e ("drm/vc4: hdmi: Enable the scrambler")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Link: https://lore.kernel.org/r/20211025152903.1088803-10-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 49944644a9b36..e880bdd8dcfd2 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -162,6 +162,8 @@ static void vc4_hdmi_cec_update_clk_div(struct vc4_hdmi *vc4_hdmi)
static void vc4_hdmi_cec_update_clk_div(struct vc4_hdmi *vc4_hdmi) {}
#endif
+static void vc4_hdmi_enable_scrambling(struct drm_encoder *encoder);
+
static enum drm_connector_status
vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
{
@@ -190,6 +192,7 @@ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
}
}
+ vc4_hdmi_enable_scrambling(&vc4_hdmi->encoder.base.base);
pm_runtime_put(&vc4_hdmi->pdev->dev);
return connector_status_connected;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 098/846] libbpf: Free up resources used by inner map definition
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 097/846] drm/vc4: hdmi: Enable the scrambler on reconnection Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 099/846] wcn36xx: Fix DMA channel enable/disable cycle Greg Kroah-Hartman
` (751 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
Hengqi Chen, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 8f7b239ea8cfdc8e64c875ee417fed41431a1f37 ]
It's not enough to just free(map->inner_map), as inner_map itself can
have extra memory allocated, like map name.
Fixes: 646f02ffdd49 ("libbpf: Add BTF-defined map-in-map support")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Hengqi Chen <hengqi.chen@gmail.com>
Link: https://lore.kernel.org/bpf/20211107165521.9240-3-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 7145463a4a562..0ad29203cbfbf 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -8676,7 +8676,10 @@ int bpf_map__set_inner_map_fd(struct bpf_map *map, int fd)
pr_warn("error: inner_map_fd already specified\n");
return libbpf_err(-EINVAL);
}
- zfree(&map->inner_map);
+ if (map->inner_map) {
+ bpf_map__destroy(map->inner_map);
+ zfree(&map->inner_map);
+ }
map->inner_map_fd = fd;
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 099/846] wcn36xx: Fix DMA channel enable/disable cycle
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 098/846] libbpf: Free up resources used by inner map definition Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 100/846] wcn36xx: Release DMA channel descriptor allocations Greg Kroah-Hartman
` (750 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[ Upstream commit 89dcb1da611d9b3ff0728502d58372fdaae9ebff ]
Right now we have a broken sequence where we enable DMA channel interrupts
which can be left enabled and never disabled if we hit an error path.
Worse still when we unload the driver, the DMA channel interrupt bits are
left intact. About the only saving grace here is that we do remember to
disable the wcnss interrupt when unload the driver.
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211105122152.1580542-2-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/dxe.c | 38 ++++++++++++++++++--------
1 file changed, 27 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index aff04ef662663..0c4f63f1312f8 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -272,6 +272,21 @@ static int wcn36xx_dxe_enable_ch_int(struct wcn36xx *wcn, u16 wcn_ch)
return 0;
}
+static void wcn36xx_dxe_disable_ch_int(struct wcn36xx *wcn, u16 wcn_ch)
+{
+ int reg_data = 0;
+
+ wcn36xx_dxe_read_register(wcn,
+ WCN36XX_DXE_INT_MASK_REG,
+ ®_data);
+
+ reg_data &= ~wcn_ch;
+
+ wcn36xx_dxe_write_register(wcn,
+ WCN36XX_DXE_INT_MASK_REG,
+ (int)reg_data);
+}
+
static int wcn36xx_dxe_fill_skb(struct device *dev,
struct wcn36xx_dxe_ctl *ctl,
gfp_t gfp)
@@ -869,7 +884,6 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
WCN36XX_DXE_WQ_TX_L);
wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, ®_data);
- wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
/***************************************/
/* Init descriptors for TX HIGH channel */
@@ -893,9 +907,6 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, ®_data);
- /* Enable channel interrupts */
- wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
-
/***************************************/
/* Init descriptors for RX LOW channel */
/***************************************/
@@ -905,7 +916,6 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
goto out_err_rxl_ch;
}
-
/* For RX we need to preallocated buffers */
wcn36xx_dxe_ch_alloc_skb(wcn, &wcn->dxe_rx_l_ch);
@@ -928,9 +938,6 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
WCN36XX_DXE_REG_CTL_RX_L,
WCN36XX_DXE_CH_DEFAULT_CTL_RX_L);
- /* Enable channel interrupts */
- wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
-
/***************************************/
/* Init descriptors for RX HIGH channel */
/***************************************/
@@ -962,15 +969,18 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
WCN36XX_DXE_REG_CTL_RX_H,
WCN36XX_DXE_CH_DEFAULT_CTL_RX_H);
- /* Enable channel interrupts */
- wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
-
ret = wcn36xx_dxe_request_irqs(wcn);
if (ret < 0)
goto out_err_irq;
timer_setup(&wcn->tx_ack_timer, wcn36xx_dxe_tx_timer, 0);
+ /* Enable channel interrupts */
+ wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
+ wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
+ wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
+ wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
+
return 0;
out_err_irq:
@@ -987,6 +997,12 @@ out_err_txh_ch:
void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
{
+ /* Disable channel interrupts */
+ wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
+ wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
+ wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
+ wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
+
free_irq(wcn->tx_irq, wcn);
free_irq(wcn->rx_irq, wcn);
del_timer(&wcn->tx_ack_timer);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 100/846] wcn36xx: Release DMA channel descriptor allocations
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 099/846] wcn36xx: Fix DMA channel enable/disable cycle Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 101/846] wcn36xx: Put DXE block into reset before freeing memory Greg Kroah-Hartman
` (749 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[ Upstream commit 3652096e5263ad67604b0323f71d133485f410e5 ]
When unloading the driver we are not releasing the DMA descriptors which we
previously allocated.
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211105122152.1580542-3-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/dxe.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 0c4f63f1312f8..017c7d78072ba 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -1014,4 +1014,9 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
+
+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_l_ch);
+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_h_ch);
+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_l_ch);
+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_h_ch);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 101/846] wcn36xx: Put DXE block into reset before freeing memory
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 100/846] wcn36xx: Release DMA channel descriptor allocations Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 102/846] wcn36xx: populate band before determining rate on RX Greg Kroah-Hartman
` (748 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[ Upstream commit ed04ea76e69e7194f7489cebe23a32a68f39218d ]
When deiniting the DXE hardware we should reset the block to ensure there
is no spurious DMA write transaction from the downstream WCNSS to upstream
MSM at a skbuff address we will have released.
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211105122152.1580542-4-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/dxe.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 017c7d78072ba..e1a35c2eadb6c 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -997,6 +997,8 @@ out_err_txh_ch:
void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
{
+ int reg_data = 0;
+
/* Disable channel interrupts */
wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
@@ -1012,6 +1014,10 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
wcn->tx_ack_skb = NULL;
}
+ /* Put the DXE block into reset before freeing memory */
+ reg_data = WCN36XX_DXE_REG_RESET;
+ wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_REG_CSR_RESET, reg_data);
+
wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 102/846] wcn36xx: populate band before determining rate on RX
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 101/846] wcn36xx: Put DXE block into reset before freeing memory Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 103/846] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates Greg Kroah-Hartman
` (747 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Li, Loic Poulain,
Kalle Valo, Sasha Levin
From: Benjamin Li <benl@squareup.com>
[ Upstream commit c9c5608fafe4dae975c9644c7d14c51ad3b0ed73 ]
status.band is used in determination of status.rate -- for 5GHz on legacy
rates there is a linear shift between the BD descriptor's rate field and
the wcn36xx driver's rate table (wcn_5ghz_rates).
We have a special clause to populate status.band for hardware scan offload
frames. However, this block occurs after status.rate is already populated.
Correctly handle this dependency by moving the band block before the rate
block.
This patch addresses kernel warnings & missing scan results for 5GHz APs
that send their beacons/probe responses at the higher four legacy rates
(24-54 Mbps), when using hardware scan offload:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:4532 ieee80211_rx_napi+0x744/0x8d8
Modules linked in: wcn36xx [...]
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 4.19.107-g73909fa #1
Hardware name: Square, Inc. T2 (all variants) (DT)
Call trace:
dump_backtrace+0x0/0x148
show_stack+0x14/0x1c
dump_stack+0xb8/0xf0
__warn+0x2ac/0x2d8
warn_slowpath_null+0x44/0x54
ieee80211_rx_napi+0x744/0x8d8
ieee80211_tasklet_handler+0xa4/0xe0
tasklet_action_common+0xe0/0x118
tasklet_action+0x20/0x28
__do_softirq+0x108/0x1ec
irq_exit+0xd4/0xd8
__handle_domain_irq+0x84/0xbc
gic_handle_irq+0x4c/0xb8
el1_irq+0xe8/0x190
lpm_cpuidle_enter+0x220/0x260
cpuidle_enter_state+0x114/0x1c0
cpuidle_enter+0x34/0x48
do_idle+0x150/0x268
cpu_startup_entry+0x20/0x24
rest_init+0xd4/0xe0
start_kernel+0x398/0x430
---[ end trace ae28cb759352b403 ]---
Fixes: 8a27ca394782 ("wcn36xx: Correct band/freq reporting on RX")
Signed-off-by: Benjamin Li <benl@squareup.com>
Tested-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211104010548.1107405-2-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/txrx.c | 37 +++++++++++++------------
1 file changed, 19 insertions(+), 18 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index bbd7194c82e27..f76de106570d2 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -259,8 +259,6 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
fc = __le16_to_cpu(hdr->frame_control);
sn = IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl));
- status.freq = WCN36XX_CENTER_FREQ(wcn);
- status.band = WCN36XX_BAND(wcn);
status.mactime = 10;
status.signal = -get_rssi0(bd);
status.antenna = 1;
@@ -272,6 +270,25 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
wcn36xx_dbg(WCN36XX_DBG_RX, "status.flags=%x\n", status.flag);
+ if (bd->scan_learn) {
+ /* If packet originate from hardware scanning, extract the
+ * band/channel from bd descriptor.
+ */
+ u8 hwch = (bd->reserved0 << 4) + bd->rx_ch;
+
+ if (bd->rf_band != 1 && hwch <= sizeof(ab_rx_ch_map) && hwch >= 1) {
+ status.band = NL80211_BAND_5GHZ;
+ status.freq = ieee80211_channel_to_frequency(ab_rx_ch_map[hwch - 1],
+ status.band);
+ } else {
+ status.band = NL80211_BAND_2GHZ;
+ status.freq = ieee80211_channel_to_frequency(hwch, status.band);
+ }
+ } else {
+ status.band = WCN36XX_BAND(wcn);
+ status.freq = WCN36XX_CENTER_FREQ(wcn);
+ }
+
if (bd->rate_id < ARRAY_SIZE(wcn36xx_rate_table)) {
rate = &wcn36xx_rate_table[bd->rate_id];
status.encoding = rate->encoding;
@@ -298,22 +315,6 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
ieee80211_is_probe_resp(hdr->frame_control))
status.boottime_ns = ktime_get_boottime_ns();
- if (bd->scan_learn) {
- /* If packet originates from hardware scanning, extract the
- * band/channel from bd descriptor.
- */
- u8 hwch = (bd->reserved0 << 4) + bd->rx_ch;
-
- if (bd->rf_band != 1 && hwch <= sizeof(ab_rx_ch_map) && hwch >= 1) {
- status.band = NL80211_BAND_5GHZ;
- status.freq = ieee80211_channel_to_frequency(ab_rx_ch_map[hwch - 1],
- status.band);
- } else {
- status.band = NL80211_BAND_2GHZ;
- status.freq = ieee80211_channel_to_frequency(hwch, status.band);
- }
- }
-
memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
if (ieee80211_is_beacon(hdr->frame_control)) {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 103/846] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 102/846] wcn36xx: populate band before determining rate on RX Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 104/846] ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware Greg Kroah-Hartman
` (746 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Li, Loic Poulain,
Kalle Valo, Sasha Levin
From: Benjamin Li <benl@squareup.com>
[ Upstream commit cfdf6b19e750f7de8ae71a26932f63b52e3bf74c ]
The linear mapping between the BD rate field and the driver's 5GHz
legacy rates table (wcn_5ghz_rates) does not only apply for the latter
four rates -- it applies to all eight rates.
Fixes: 6ea131acea98 ("wcn36xx: Fix warning due to bad rate_idx")
Signed-off-by: Benjamin Li <benl@squareup.com>
Tested-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211104010548.1107405-3-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/txrx.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index f76de106570d2..f33e7228a1010 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -237,7 +237,6 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
const struct wcn36xx_rate *rate;
struct ieee80211_hdr *hdr;
struct wcn36xx_rx_bd *bd;
- struct ieee80211_supported_band *sband;
u16 fc, sn;
/*
@@ -295,12 +294,11 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
status.enc_flags = rate->encoding_flags;
status.bw = rate->bw;
status.rate_idx = rate->mcs_or_legacy_index;
- sband = wcn->hw->wiphy->bands[status.band];
status.nss = 1;
if (status.band == NL80211_BAND_5GHZ &&
status.encoding == RX_ENC_LEGACY &&
- status.rate_idx >= sband->n_bitrates) {
+ status.rate_idx >= 4) {
/* no dsss rates in 5Ghz rates table */
status.rate_idx -= 4;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 104/846] ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 103/846] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 105/846] bpftool: Fix memory leak in prog_dump() Greg Kroah-Hartman
` (745 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sathishkumar Muruganandam,
Rameshkumar Sundaram, Jouni Malinen, Kalle Valo, Sasha Levin
From: Rameshkumar Sundaram <ramess@codeaurora.org>
[ Upstream commit 16a2c3d5406f95ef6139de52669c60a39443f5f7 ]
HTT_PPDU_STATS_CFG_PDEV_ID bit mask for target FW PPDU stats request message
was set as bit 8 to 15. Bit 8 is reserved for soc stats and pdev id starts from
bit 9. Hence change the bitmask as bit 9 to 15 and fill the proper pdev id in
the request message.
In commit 701e48a43e15 ("ath11k: add packet log support for QCA6390"), both
HTT_PPDU_STATS_CFG_PDEV_ID and pdev_mask were changed, but this pdev_mask
calculation is not valid for platforms which has multiple pdevs with 1 rxdma
per pdev, as this is writing same value(i.e. 2) for all pdevs. Hence fixed it
to consider pdev_idx as well, to make it compatible for both single and multi
pd cases.
Tested on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01092-QCAHKSWPL_SILICONZ-1
Tested on: IPQ6018 hw1.0 WLAN.HK.2.5.0.1-01067-QCAHKSWPL_SILICONZ-1
Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
Co-developed-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210721212029.142388-10-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/dp.h | 3 ++-
drivers/net/wireless/ath/ath11k/dp_tx.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/dp.h b/drivers/net/wireless/ath/ath11k/dp.h
index ee768ccce46e1..d3e50e34f23dd 100644
--- a/drivers/net/wireless/ath/ath11k/dp.h
+++ b/drivers/net/wireless/ath/ath11k/dp.h
@@ -515,7 +515,8 @@ struct htt_ppdu_stats_cfg_cmd {
} __packed;
#define HTT_PPDU_STATS_CFG_MSG_TYPE GENMASK(7, 0)
-#define HTT_PPDU_STATS_CFG_PDEV_ID GENMASK(15, 8)
+#define HTT_PPDU_STATS_CFG_SOC_STATS BIT(8)
+#define HTT_PPDU_STATS_CFG_PDEV_ID GENMASK(15, 9)
#define HTT_PPDU_STATS_CFG_TLV_TYPE_BITMASK GENMASK(31, 16)
enum htt_ppdu_stats_tag_type {
diff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless/ath/ath11k/dp_tx.c
index 8bba5234f81fc..bb8744ccfa00c 100644
--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -895,7 +895,7 @@ int ath11k_dp_tx_htt_h2t_ppdu_stats_req(struct ath11k *ar, u32 mask)
cmd->msg = FIELD_PREP(HTT_PPDU_STATS_CFG_MSG_TYPE,
HTT_H2T_MSG_TYPE_PPDU_STATS_CFG);
- pdev_mask = 1 << (i + 1);
+ pdev_mask = 1 << (ar->pdev_idx + i);
cmd->msg |= FIELD_PREP(HTT_PPDU_STATS_CFG_PDEV_ID, pdev_mask);
cmd->msg |= FIELD_PREP(HTT_PPDU_STATS_CFG_TLV_TYPE_BITMASK, mask);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 105/846] bpftool: Fix memory leak in prog_dump()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 104/846] ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 106/846] mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init() Greg Kroah-Hartman
` (744 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quentin Monnet, Andrii Nakryiko, Sasha Levin
From: Quentin Monnet <quentin@isovalent.com>
[ Upstream commit ebbd7f64a3fbe9e0f235e39fc244ee9735e2a52a ]
Following the extraction of prog_dump() from do_dump(), the struct btf
allocated in prog_dump() is no longer freed on error; the struct
bpf_prog_linfo is not freed at all. Make sure we release them before
exiting the function.
Fixes: ec2025095cf6 ("bpftool: Match several programs with same tag")
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20211110114632.24537-2-quentin@isovalent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/prog.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index fe59404e87046..f8755beb3d9eb 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -629,8 +629,8 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
char func_sig[1024];
unsigned char *buf;
__u32 member_len;
+ int fd, err = -1;
ssize_t n;
- int fd;
if (mode == DUMP_JITED) {
if (info->jited_prog_len == 0 || !info->jited_prog_insns) {
@@ -669,7 +669,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
if (fd < 0) {
p_err("can't open file %s: %s", filepath,
strerror(errno));
- return -1;
+ goto exit_free;
}
n = write(fd, buf, member_len);
@@ -677,7 +677,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
if (n != (ssize_t)member_len) {
p_err("error writing output file: %s",
n < 0 ? strerror(errno) : "short write");
- return -1;
+ goto exit_free;
}
if (json_output)
@@ -691,7 +691,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
info->netns_ino,
&disasm_opt);
if (!name)
- return -1;
+ goto exit_free;
}
if (info->nr_jited_func_lens && info->jited_func_lens) {
@@ -786,9 +786,12 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
kernel_syms_destroy(&dd);
}
- btf__free(btf);
+ err = 0;
- return 0;
+exit_free:
+ btf__free(btf);
+ bpf_prog_linfo__free(prog_linfo);
+ return err;
}
static int do_dump(int argc, char **argv)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 106/846] mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 105/846] bpftool: Fix memory leak in prog_dump() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 107/846] media: videobuf2: Fix the size printk format Greg Kroah-Hartman
` (743 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Vignesh Raghavendra,
Biju Das, Wolfram Sang, Geert Uytterhoeven, Sasha Levin
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 981387ed06b96908223a607f5fba6efa42728fc2 ]
rpcif_sw_init() can fail so make sure we check the return value
of it and on error exit rpcif_hb_probe() callback with error code.
Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20211025205631.21151-5-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/hyperbus/rpc-if.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
index ecb050ba95cdf..367b0d72bf622 100644
--- a/drivers/mtd/hyperbus/rpc-if.c
+++ b/drivers/mtd/hyperbus/rpc-if.c
@@ -124,7 +124,9 @@ static int rpcif_hb_probe(struct platform_device *pdev)
if (!hyperbus)
return -ENOMEM;
- rpcif_sw_init(&hyperbus->rpc, pdev->dev.parent);
+ error = rpcif_sw_init(&hyperbus->rpc, pdev->dev.parent);
+ if (error)
+ return error;
platform_set_drvdata(pdev, hyperbus);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 107/846] media: videobuf2: Fix the size printk format
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 106/846] mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 108/846] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() Greg Kroah-Hartman
` (742 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dillon Min, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Dillon Min <dillon.minfei@gmail.com>
[ Upstream commit c9ee220d76775e42f35d634479c978d9350077d3 ]
Since the type of parameter size is unsigned long,
it should printk by %lu, instead of %ld, fix it.
Fixes: 7952be9b6ece ("media: drivers/media/common/videobuf2: rename from videobuf")
Signed-off-by: Dillon Min <dillon.minfei@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/common/videobuf2/videobuf2-dma-contig.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
index be376f3011b68..f8c65b0401054 100644
--- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c
+++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
@@ -157,7 +157,7 @@ static void *vb2_dc_alloc(struct vb2_buffer *vb,
GFP_KERNEL | vb->vb2_queue->gfp_flags,
buf->attrs);
if (!buf->cookie) {
- dev_err(dev, "dma_alloc_coherent of size %ld failed\n", size);
+ dev_err(dev, "dma_alloc_coherent of size %lu failed\n", size);
kfree(buf);
return ERR_PTR(-ENOMEM);
}
@@ -204,9 +204,9 @@ static int vb2_dc_mmap(void *buf_priv, struct vm_area_struct *vma)
vma->vm_ops->open(vma);
- pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %ld\n",
- __func__, (unsigned long)buf->dma_addr, vma->vm_start,
- buf->size);
+ pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %lu\n",
+ __func__, (unsigned long)buf->dma_addr, vma->vm_start,
+ buf->size);
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 108/846] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 107/846] media: videobuf2: Fix the size printk format Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 109/846] media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case Greg Kroah-Hartman
` (741 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit ce3015b7212e96db426d0c36f80fd159c91155d1 ]
After the commit 9832e155f1ed ("[media] media-device: split media
initialization and registration"), calling media_device_cleanup()
is needed it seems. However, currently it is missing for the module
unload path.
Note that for the probe failure path, it is already added in
atomisp_register_entities().
This patch adds the missing call of media_device_cleanup() in
atomisp_unregister_entities().
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
index 1e324f1f656e5..0511c454e769d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
@@ -1182,6 +1182,7 @@ static void atomisp_unregister_entities(struct atomisp_device *isp)
v4l2_device_unregister(&isp->v4l2_dev);
media_device_unregister(&isp->media_dev);
+ media_device_cleanup(&isp->media_dev);
}
static int atomisp_register_entities(struct atomisp_device *isp)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 109/846] media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 108/846] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 110/846] media: atomisp: fix inverted logic in buffers_needed() Greg Kroah-Hartman
` (740 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit 5bfbf65fcca7325e4d89d289b3c286e11220e386 ]
When comparing with intel-aero atomisp [1], it looks like
punit_ddr_dvfs_enable() should take `false` as an argument on mrfld_power
up case.
Code from the intel-aero kernel [1]:
int atomisp_mrfld_power_down(struct atomisp_device *isp)
{
[...]
/*WA:Enable DVFS*/
if (IS_CHT)
punit_ddr_dvfs_enable(true);
int atomisp_mrfld_power_up(struct atomisp_device *isp)
{
[...]
/*WA for PUNIT, if DVFS enabled, ISP timeout observed*/
if (IS_CHT)
punit_ddr_dvfs_enable(false);
This patch fixes the inverted argument as per the intel-aero code, as
well as its comment. While here, fix space issues for comments in
atomisp_mrfld_power().
Note that it does not seem to be possible to unify the up/down cases for
punit_ddr_dvfs_enable(), i.e., we can't do something like the following:
if (IS_CHT)
punit_ddr_dvfs_enable(!enable);
because according to the intel-aero code [1], the DVFS is disabled
before "writing 0x0 to ISPSSPM0 bit[1:0]" and the DVFS is enabled after
"writing 0x3 to ISPSSPM0 bit[1:0]".
[1] https://github.com/intel-aero/linux-kernel/blob/a1b673258feb915268377275130c5c5df0eafc82/drivers/media/pci/atomisp/atomisp_driver/atomisp_v4l2.c#L431-L514
Fixes: 0f441fd70b1e ("media: atomisp: simplify the power down/up code")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
index 0511c454e769d..7982cc143374a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
@@ -711,15 +711,15 @@ static int atomisp_mrfld_power(struct atomisp_device *isp, bool enable)
dev_dbg(isp->dev, "IUNIT power-%s.\n", enable ? "on" : "off");
- /*WA:Enable DVFS*/
+ /* WA for P-Unit, if DVFS enabled, ISP timeout observed */
if (IS_CHT && enable)
- punit_ddr_dvfs_enable(true);
+ punit_ddr_dvfs_enable(false);
/*
* FIXME:WA for ECS28A, with this sleep, CTS
* android.hardware.camera2.cts.CameraDeviceTest#testCameraDeviceAbort
* PASS, no impact on other platforms
- */
+ */
if (IS_BYT && enable)
msleep(10);
@@ -727,7 +727,7 @@ static int atomisp_mrfld_power(struct atomisp_device *isp, bool enable)
iosf_mbi_modify(BT_MBI_UNIT_PMC, MBI_REG_READ, MRFLD_ISPSSPM0,
val, MRFLD_ISPSSPM0_ISPSSC_MASK);
- /*WA:Enable DVFS*/
+ /* WA:Enable DVFS */
if (IS_CHT && !enable)
punit_ddr_dvfs_enable(true);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 110/846] media: atomisp: fix inverted logic in buffers_needed()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 109/846] media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 111/846] media: atomisp: do not use err var when checking port validity for ISP2400 Greg Kroah-Hartman
` (739 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit e1921cd14640f0f4d1fad5eb8e448c58a536415d ]
When config.mode is IA_CSS_INPUT_MODE_BUFFERED_SENSOR, it rather needs
buffers. Fix it by inverting the return value.
Fixes: 3c0538fbad9f ("media: atomisp: get rid of most checks for ISP2401 version")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/sh_css_mipi.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_mipi.c b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
index 75489f7d75eec..483d40a467c74 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_mipi.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
@@ -374,17 +374,17 @@ static bool buffers_needed(struct ia_css_pipe *pipe)
{
if (!IS_ISP2401) {
if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR)
- return false;
- else
return true;
+ else
+ return false;
}
if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR ||
pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG ||
pipe->stream->config.mode == IA_CSS_INPUT_MODE_PRBS)
- return false;
+ return true;
- return true;
+ return false;
}
int
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 111/846] media: atomisp: do not use err var when checking port validity for ISP2400
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 110/846] media: atomisp: fix inverted logic in buffers_needed() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 112/846] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() Greg Kroah-Hartman
` (738 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit 9f6b4fa2d2dfbff4b8a57eeb39b1128a6094ee20 ]
Currently, the `port >= N_CSI_PORTS || err` checks for ISP2400 are always
evaluated as true because the err variable is set to `-EINVAL` on
declaration but the variable is never used until the evaluation.
Looking at the diff of commit 3c0538fbad9f ("media: atomisp: get rid of
most checks for ISP2401 version"), the `port >= N_CSI_PORTS` check is
for ISP2400 and the err variable check is for ISP2401. Fix this issue
by adding ISP version test there accordingly.
Fixes: 3c0538fbad9f ("media: atomisp: get rid of most checks for ISP2401 version")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/sh_css_mipi.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_mipi.c b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
index 483d40a467c74..65fc93c5d56bc 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_mipi.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
@@ -430,7 +430,8 @@ allocate_mipi_frames(struct ia_css_pipe *pipe,
assert(port < N_CSI_PORTS);
- if (port >= N_CSI_PORTS || err) {
+ if ((!IS_ISP2401 && port >= N_CSI_PORTS) ||
+ (IS_ISP2401 && err)) {
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"allocate_mipi_frames(%p) exit: error: port is not correct (port=%d).\n",
pipe, port);
@@ -559,7 +560,8 @@ free_mipi_frames(struct ia_css_pipe *pipe)
assert(port < N_CSI_PORTS);
- if (port >= N_CSI_PORTS || err) {
+ if ((!IS_ISP2401 && port >= N_CSI_PORTS) ||
+ (IS_ISP2401 && err)) {
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"free_mipi_frames(%p, %d) exit: error: pipe port is not correct.\n",
pipe, port);
@@ -670,7 +672,8 @@ send_mipi_frames(struct ia_css_pipe *pipe)
assert(port < N_CSI_PORTS);
- if (port >= N_CSI_PORTS || err) {
+ if ((!IS_ISP2401 && port >= N_CSI_PORTS) ||
+ (IS_ISP2401 && err)) {
IA_CSS_ERROR("send_mipi_frames(%p) exit: invalid port specified (port=%d).\n",
pipe, port);
return err;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 112/846] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 111/846] media: atomisp: do not use err var when checking port validity for ISP2400 Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 113/846] media: atomisp: fix ifdefs in sh_css.c Greg Kroah-Hartman
` (737 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit d21ce8c2f7bf6d737b60c09f86db141b9e8e47f0 ]
The function ia_css_mipi_is_source_port_valid() returns true if the port
is valid. So, we can't use the existing err variable as is.
To fix this issue while reusing that variable, invert the return value
when assigning it to the variable.
Fixes: 3c0538fbad9f ("media: atomisp: get rid of most checks for ISP2401 version")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../staging/media/atomisp/pci/sh_css_mipi.c | 24 ++++++++++++-------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_mipi.c b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
index 65fc93c5d56bc..c1f2f6151c5f8 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_mipi.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
@@ -423,10 +423,12 @@ allocate_mipi_frames(struct ia_css_pipe *pipe,
return 0; /* AM TODO: Check */
}
- if (!IS_ISP2401)
+ if (!IS_ISP2401) {
port = (unsigned int)pipe->stream->config.source.port.port;
- else
- err = ia_css_mipi_is_source_port_valid(pipe, &port);
+ } else {
+ /* Returns true if port is valid. So, invert it */
+ err = !ia_css_mipi_is_source_port_valid(pipe, &port);
+ }
assert(port < N_CSI_PORTS);
@@ -553,10 +555,12 @@ free_mipi_frames(struct ia_css_pipe *pipe)
return err;
}
- if (!IS_ISP2401)
+ if (!IS_ISP2401) {
port = (unsigned int)pipe->stream->config.source.port.port;
- else
- err = ia_css_mipi_is_source_port_valid(pipe, &port);
+ } else {
+ /* Returns true if port is valid. So, invert it */
+ err = !ia_css_mipi_is_source_port_valid(pipe, &port);
+ }
assert(port < N_CSI_PORTS);
@@ -665,10 +669,12 @@ send_mipi_frames(struct ia_css_pipe *pipe)
/* TODO: AM: maybe this should be returning an error. */
}
- if (!IS_ISP2401)
+ if (!IS_ISP2401) {
port = (unsigned int)pipe->stream->config.source.port.port;
- else
- err = ia_css_mipi_is_source_port_valid(pipe, &port);
+ } else {
+ /* Returns true if port is valid. So, invert it */
+ err = !ia_css_mipi_is_source_port_valid(pipe, &port);
+ }
assert(port < N_CSI_PORTS);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 113/846] media: atomisp: fix ifdefs in sh_css.c
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 112/846] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 114/846] media: atomisp: add NULL check for asd obtained from atomisp_video_pipe Greg Kroah-Hartman
` (736 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit 5a1b2725558f8a3b4cbf0504f53cffae8e163034 ]
## `if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG) {` case
The intel-aero atomisp has `#if defined(IS_ISP_2400_SYSTEM)` [1]. It is
to be defined in the following two places [2]:
- css/hive_isp_css_common/system_global.h
- css/css_2401_csi2p_system/system_global.h
and the former file is to be included on ISP2400 devices, too. So, it
is to be defined for both ISP2400 and ISP2401 devices.
Because the upstreamed atomisp driver now supports only ISP2400 and
ISP2401, just remove the ISP version test again. This matches the other
upstream commits like 3c0538fbad9f ("media: atomisp: get rid of most
checks for ISP2401 version").
While here, moved the comment for define GP_ISEL_TPG_MODE to the
appropriate place.
[1] https://github.com/intel-aero/linux-kernel/blob/a1b673258feb915268377275130c5c5df0eafc82/drivers/media/pci/atomisp/css/sh_css.c#L552-L558
[2] https://github.com/intel-aero/linux-kernel/search?q=IS_ISP_2400_SYSTEM
## `isys_stream_descr->polling_mode` case
This does not exist on the intel-aero atomisp. This is because it is
based on css version irci_stable_candrpv_0415_20150521_0458.
On the other hand, the upstreamed atomisp is based on the following css
version depending on the ISP version using ifdefs:
- ISP2400: irci_stable_candrpv_0415_20150521_0458
- ISP2401: irci_master_20150911_0724
The `isys_stream_descr->polling_mode` usage was added on updating css
version to irci_master_20150701_0213 [3].
So, it is not a ISP version specific thing, but css version specific
thing. Because the upstreamed atomisp driver uses irci_master_20150911_0724
for ISP2401, re-add the ISP version check for now.
I say "for now" because ISP2401 should eventually use the same css
version with ISP2400 (i.e., irci_stable_candrpv_0415_20150521_0458)
[3] https://raw.githubusercontent.com/intel/ProductionKernelQuilts/cht-m1stable-2016_ww31/uefi/cht-m1stable/patches/cam-0439-atomisp2-css2401-and-2401_legacy-irci_master_2015070.patch
("atomisp2: css2401 and 2401_legacy-irci_master_20150701_0213")
Link to Intel's Android kernel patch.
## `coord = &me->config.internal_frame_origin_bqs_on_sctbl;` case
it was added on commit 4f744a573db3 ("media: atomisp: make
sh_css_sp_init_pipeline() ISP version independent") for ISP2401. Because
the upstreamed atomisp for the ISP2401 part is based on
irci_master_20150911_0724, hence the difference.
Because the upstreamed atomisp driver uses irci_master_20150911_0724
for ISP2401, revert the test back to `if (IS_ISP2401)`.
Fixes: 27333dadef57 ("media: atomisp: adjust some code at sh_css that could be broken")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/sh_css.c | 27 +++++++++-------------
1 file changed, 11 insertions(+), 16 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c
index c4b35cbab3737..ba25d0da8b811 100644
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -522,6 +522,7 @@ ia_css_stream_input_format_bits_per_pixel(struct ia_css_stream *stream)
return bpp;
}
+/* TODO: move define to proper file in tools */
#define GP_ISEL_TPG_MODE 0x90058
#if !defined(ISP2401)
@@ -573,12 +574,8 @@ sh_css_config_input_network(struct ia_css_stream *stream)
vblank_cycles = vblank_lines * (width + hblank_cycles);
sh_css_sp_configure_sync_gen(width, height, hblank_cycles,
vblank_cycles);
- if (!IS_ISP2401) {
- if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG) {
- /* TODO: move define to proper file in tools */
- ia_css_device_store_uint32(GP_ISEL_TPG_MODE, 0);
- }
- }
+ if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG)
+ ia_css_device_store_uint32(GP_ISEL_TPG_MODE, 0);
}
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"sh_css_config_input_network() leave:\n");
@@ -1009,16 +1006,14 @@ static bool sh_css_translate_stream_cfg_to_isys_stream_descr(
* ia_css_isys_stream_capture_indication() instead of
* ia_css_pipeline_sp_wait_for_isys_stream_N() as isp processing of
* capture takes longer than getting an ISYS frame
- *
- * Only 2401 relevant ??
*/
-#if 0 // FIXME: NOT USED on Yocto Aero
- isys_stream_descr->polling_mode
- = early_polling ? INPUT_SYSTEM_POLL_ON_CAPTURE_REQUEST
- : INPUT_SYSTEM_POLL_ON_WAIT_FOR_FRAME;
- ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
- "sh_css_translate_stream_cfg_to_isys_stream_descr() leave:\n");
-#endif
+ if (IS_ISP2401) {
+ isys_stream_descr->polling_mode
+ = early_polling ? INPUT_SYSTEM_POLL_ON_CAPTURE_REQUEST
+ : INPUT_SYSTEM_POLL_ON_WAIT_FOR_FRAME;
+ ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
+ "sh_css_translate_stream_cfg_to_isys_stream_descr() leave:\n");
+ }
return rc;
}
@@ -1433,7 +1428,7 @@ static void start_pipe(
assert(me); /* all callers are in this file and call with non null argument */
- if (!IS_ISP2401) {
+ if (IS_ISP2401) {
coord = &me->config.internal_frame_origin_bqs_on_sctbl;
params = me->stream->isp_params_configs;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 114/846] media: atomisp: add NULL check for asd obtained from atomisp_video_pipe
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 113/846] media: atomisp: fix ifdefs in sh_css.c Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 115/846] media: atomisp: fix enum formats logic Greg Kroah-Hartman
` (735 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit c10bcb13462e9cf43111d17f1e08b4bb4d4401b0 ]
This is almost a BUG report with RFC patch that just avoids kernel
oopses. Thus, prefixed with [BUG][RFC].
Here is the kernel log after running `v4l2-compliance -d /dev/video4`
with this patch applied:
kern :err : [25507.580392] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.592343] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.592995] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.593685] atomisp-isp2 0000:00:03.0: atomisp_g_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.593719] atomisp-isp2 0000:00:03.0: atomisp_g_parm(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.593727] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
[omitting 42 same messages]
kern :err : [25507.593976] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594191] atomisp-isp2 0000:00:03.0: atomisp_g_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594449] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
[omitting 43 same messages]
kern :err : [25507.594756] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594779] atomisp-isp2 0000:00:03.0: atomisp_g_ctrl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594787] atomisp-isp2 0000:00:03.0: atomisp_s_ctrl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594803] atomisp-isp2 0000:00:03.0: atomisp_camera_g_ext_ctrls(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594880] atomisp-isp2 0000:00:03.0: atomisp_enum_fmt_cap(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594915] atomisp-isp2 0000:00:03.0: atomisp_g_parm(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595058] atomisp-isp2 0000:00:03.0: atomisp_try_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595089] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595124] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595221] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595241] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.601571] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.607496] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.608604] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.611988] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.617420] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.618429] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.618811] atomisp-isp2 0000:00:03.0: atomisp_g_parm(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.622193] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.627355] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.628391] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.631143] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.635813] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.636489] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.636504] atomisp-isp2 0000:00:03.0: atomisp_s_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.636516] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.639111] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.646152] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.646831] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.646847] atomisp-isp2 0000:00:03.0: atomisp_s_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.650079] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.657476] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.658741] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.658759] atomisp-isp2 0000:00:03.0: atomisp_s_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.658771] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.660959] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.666665] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.667397] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
[mchehab: fix coding style]
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../staging/media/atomisp/pci/atomisp_cmd.c | 73 +++++++++++++++
.../staging/media/atomisp/pci/atomisp_fops.c | 6 ++
.../staging/media/atomisp/pci/atomisp_ioctl.c | 90 +++++++++++++++++++
3 files changed, 169 insertions(+)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index 366161cff5602..75a531667d743 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -1715,6 +1715,12 @@ void atomisp_wdt_refresh_pipe(struct atomisp_video_pipe *pipe,
{
unsigned long next;
+ if (!pipe->asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return;
+ }
+
if (delay != ATOMISP_WDT_KEEP_CURRENT_DELAY)
pipe->wdt_duration = delay;
@@ -1777,6 +1783,12 @@ void atomisp_wdt_refresh(struct atomisp_sub_device *asd, unsigned int delay)
/* ISP2401 */
void atomisp_wdt_stop_pipe(struct atomisp_video_pipe *pipe, bool sync)
{
+ if (!pipe->asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return;
+ }
+
if (!atomisp_is_wdt_running(pipe))
return;
@@ -4109,6 +4121,12 @@ void atomisp_handle_parameter_and_buffer(struct atomisp_video_pipe *pipe)
unsigned long irqflags;
bool need_to_enqueue_buffer = false;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return;
+ }
+
if (atomisp_is_vf_pipe(pipe))
return;
@@ -4196,6 +4214,12 @@ int atomisp_set_parameters(struct video_device *vdev,
struct atomisp_css_params *css_param = &asd->params.css_param;
int ret;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream) {
dev_err(asd->isp->dev, "%s: internal error!\n", __func__);
return -EINVAL;
@@ -4857,6 +4881,12 @@ int atomisp_try_fmt(struct video_device *vdev, struct v4l2_pix_format *f,
int source_pad = atomisp_subdev_source_pad(vdev);
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!isp->inputs[asd->input_curr].camera)
return -EINVAL;
@@ -5198,6 +5228,12 @@ static int atomisp_set_fmt_to_isp(struct video_device *vdev,
const struct atomisp_in_fmt_conv *fc;
int ret, i;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
v4l2_fh_init(&fh.vfh, vdev);
isp_sink_crop = atomisp_subdev_get_rect(
@@ -5494,6 +5530,7 @@ static int atomisp_set_fmt_to_snr(struct video_device *vdev,
unsigned int dvs_env_w, unsigned int dvs_env_h)
{
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
+ struct atomisp_video_pipe *pipe = atomisp_to_video_pipe(vdev);
const struct atomisp_format_bridge *format;
struct v4l2_subdev_pad_config pad_cfg;
struct v4l2_subdev_state pad_state = {
@@ -5512,6 +5549,12 @@ static int atomisp_set_fmt_to_snr(struct video_device *vdev,
struct v4l2_subdev_fh fh;
int ret;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
v4l2_fh_init(&fh.vfh, vdev);
stream_index = atomisp_source_pad_to_stream_id(asd, source_pad);
@@ -5602,6 +5645,12 @@ int atomisp_set_fmt(struct video_device *vdev, struct v4l2_format *f)
struct v4l2_subdev_fh fh;
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (source_pad >= ATOMISP_SUBDEV_PADS_NUM)
return -EINVAL;
@@ -6034,6 +6083,12 @@ int atomisp_set_fmt_file(struct video_device *vdev, struct v4l2_format *f)
struct v4l2_subdev_fh fh;
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
v4l2_fh_init(&fh.vfh, vdev);
dev_dbg(isp->dev, "setting fmt %ux%u 0x%x for file inject\n",
@@ -6359,6 +6414,12 @@ bool atomisp_is_vf_pipe(struct atomisp_video_pipe *pipe)
{
struct atomisp_sub_device *asd = pipe->asd;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return false;
+ }
+
if (pipe == &asd->video_out_vf)
return true;
@@ -6572,6 +6633,12 @@ static int atomisp_get_pipe_id(struct atomisp_video_pipe *pipe)
{
struct atomisp_sub_device *asd = pipe->asd;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return -EINVAL;
+ }
+
if (ATOMISP_USE_YUVPP(asd)) {
return IA_CSS_PIPE_ID_YUVPP;
} else if (asd->vfpp->val == ATOMISP_VFPP_DISABLE_SCALER) {
@@ -6609,6 +6676,12 @@ int atomisp_get_invalid_frame_num(struct video_device *vdev,
struct ia_css_pipe_info p_info;
int ret;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (asd->isp->inputs[asd->input_curr].camera_caps->
sensor[asd->sensor_curr].stream_num > 1) {
/* External ISP */
diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c
index f82bf082aa796..02c19b92bdccb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c
@@ -1171,6 +1171,12 @@ static int atomisp_mmap(struct file *file, struct vm_area_struct *vma)
u32 origin_size, new_size;
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!(vma->vm_flags & (VM_WRITE | VM_READ)))
return -EACCES;
diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
index c8a625667e81e..a57e640fbf791 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
@@ -646,6 +646,12 @@ static int atomisp_g_input(struct file *file, void *fh, unsigned int *input)
struct atomisp_device *isp = video_get_drvdata(vdev);
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
*input = asd->input_curr;
rt_mutex_unlock(&isp->mutex);
@@ -665,6 +671,12 @@ static int atomisp_s_input(struct file *file, void *fh, unsigned int input)
struct v4l2_subdev *motor;
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
if (input >= ATOM_ISP_MAX_INPUTS || input >= isp->input_cnt) {
dev_dbg(isp->dev, "input_cnt: %d\n", isp->input_cnt);
@@ -765,6 +777,12 @@ static int atomisp_enum_fmt_cap(struct file *file, void *fh,
unsigned int i, fi = 0;
int rval;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
rval = v4l2_subdev_call(isp->inputs[asd->input_curr].camera, pad,
enum_mbus_code, NULL, &code);
@@ -1027,6 +1045,12 @@ int __atomisp_reqbufs(struct file *file, void *fh,
u16 stream_id = atomisp_source_pad_to_stream_id(asd, source_pad);
int ret = 0, i = 0;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (req->count == 0) {
mutex_lock(&pipe->capq.vb_lock);
if (!list_empty(&pipe->capq.stream))
@@ -1154,6 +1178,12 @@ static int atomisp_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf)
u32 pgnr;
int ret = 0;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
if (isp->isp_fatal_error) {
ret = -EIO;
@@ -1389,6 +1419,12 @@ static int atomisp_dqbuf(struct file *file, void *fh, struct v4l2_buffer *buf)
struct atomisp_device *isp = video_get_drvdata(vdev);
int ret = 0;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
if (isp->isp_fatal_error) {
@@ -1640,6 +1676,12 @@ static int atomisp_streamon(struct file *file, void *fh,
int ret = 0;
unsigned long irqflags;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
dev_dbg(isp->dev, "Start stream on pad %d for asd%d\n",
atomisp_subdev_source_pad(vdev), asd->index);
@@ -1901,6 +1943,12 @@ int __atomisp_streamoff(struct file *file, void *fh, enum v4l2_buf_type type)
unsigned long flags;
bool first_streamoff = false;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
dev_dbg(isp->dev, "Stop stream on pad %d for asd%d\n",
atomisp_subdev_source_pad(vdev), asd->index);
@@ -2150,6 +2198,12 @@ static int atomisp_g_ctrl(struct file *file, void *fh,
struct atomisp_device *isp = video_get_drvdata(vdev);
int i, ret = -EINVAL;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
for (i = 0; i < ctrls_num; i++) {
if (ci_v4l2_controls[i].id == control->id) {
ret = 0;
@@ -2229,6 +2283,12 @@ static int atomisp_s_ctrl(struct file *file, void *fh,
struct atomisp_device *isp = video_get_drvdata(vdev);
int i, ret = -EINVAL;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
for (i = 0; i < ctrls_num; i++) {
if (ci_v4l2_controls[i].id == control->id) {
ret = 0;
@@ -2310,6 +2370,12 @@ static int atomisp_queryctl(struct file *file, void *fh,
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
struct atomisp_device *isp = video_get_drvdata(vdev);
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
switch (qc->id) {
case V4L2_CID_FOCUS_ABSOLUTE:
case V4L2_CID_FOCUS_RELATIVE:
@@ -2355,6 +2421,12 @@ static int atomisp_camera_g_ext_ctrls(struct file *file, void *fh,
int i;
int ret = 0;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!IS_ISP2401)
motor = isp->inputs[asd->input_curr].motor;
else
@@ -2466,6 +2538,12 @@ static int atomisp_camera_s_ext_ctrls(struct file *file, void *fh,
int i;
int ret = 0;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!IS_ISP2401)
motor = isp->inputs[asd->input_curr].motor;
else
@@ -2591,6 +2669,12 @@ static int atomisp_g_parm(struct file *file, void *fh,
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
struct atomisp_device *isp = video_get_drvdata(vdev);
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (parm->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) {
dev_err(isp->dev, "unsupported v4l2 buf type\n");
return -EINVAL;
@@ -2613,6 +2697,12 @@ static int atomisp_s_parm(struct file *file, void *fh,
int rval;
int fps;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (parm->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) {
dev_err(isp->dev, "unsupported v4l2 buf type\n");
return -EINVAL;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 115/846] media: atomisp: fix enum formats logic
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 114/846] media: atomisp: add NULL check for asd obtained from atomisp_video_pipe Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 116/846] media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr() Greg Kroah-Hartman
` (734 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab, Sasha Levin
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit fae46cb0531b45c789e39128f676f2bafa3a7b47 ]
Changeset 374d62e7aa50 ("media: v4l2-subdev: Verify v4l2_subdev_call() pad config argument")
added an extra verification for a pads parameter for enum mbus
format code.
Such change broke atomisp, because now the V4L2 core
refuses to enum MBUS formats if the state is empty.
So, add .which field in order to select the active formats,
in order to make it work again.
While here, improve error messages.
Fixes: 374d62e7aa50 ("media: v4l2-subdev: Verify v4l2_subdev_call() pad config argument")
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../staging/media/atomisp/pci/atomisp_ioctl.c | 23 ++++++++++++++-----
1 file changed, 17 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
index a57e640fbf791..29826f8e4143d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
@@ -773,7 +773,10 @@ static int atomisp_enum_fmt_cap(struct file *file, void *fh,
struct video_device *vdev = video_devdata(file);
struct atomisp_device *isp = video_get_drvdata(vdev);
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
- struct v4l2_subdev_mbus_code_enum code = { 0 };
+ struct v4l2_subdev_mbus_code_enum code = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
+ struct v4l2_subdev *camera;
unsigned int i, fi = 0;
int rval;
@@ -783,14 +786,20 @@ static int atomisp_enum_fmt_cap(struct file *file, void *fh,
return -EINVAL;
}
+ camera = isp->inputs[asd->input_curr].camera;
+ if(!camera) {
+ dev_err(isp->dev, "%s(): camera is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
- rval = v4l2_subdev_call(isp->inputs[asd->input_curr].camera, pad,
- enum_mbus_code, NULL, &code);
+
+ rval = v4l2_subdev_call(camera, pad, enum_mbus_code, NULL, &code);
if (rval == -ENOIOCTLCMD) {
dev_warn(isp->dev,
- "enum_mbus_code pad op not supported. Please fix your sensor driver!\n");
- // rval = v4l2_subdev_call(isp->inputs[asd->input_curr].camera,
- // video, enum_mbus_fmt, 0, &code.code);
+ "enum_mbus_code pad op not supported by %s. Please fix your sensor driver!\n",
+ camera->name);
}
rt_mutex_unlock(&isp->mutex);
@@ -820,6 +829,8 @@ static int atomisp_enum_fmt_cap(struct file *file, void *fh,
f->pixelformat = format->pixelformat;
return 0;
}
+ dev_err(isp->dev, "%s(): format for code %x not found.\n",
+ __func__, code.code);
return -EINVAL;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 116/846] media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 115/846] media: atomisp: fix enum formats logic Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 117/846] media: aspeed: fix mode-detect always time out at 2nd run Greg Kroah-Hartman
` (733 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kieran Bingham,
Mauro Carvalho Chehab, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit cb4d67a998e97365afdf34965b069601da1dae60 ]
The "power" pointer is not initialized on the else path and that would
lead to an Oops.
Link: https://lore.kernel.org/linux-media/20211012082150.GA31086@kili
Fixes: c30f4cb2d4c7 ("media: atomisp: Refactor PMIC detection to a separate function")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
index d8c9e31314b2e..62dc06e224765 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
@@ -481,7 +481,7 @@ fail:
static u8 gmin_get_pmic_id_and_addr(struct device *dev)
{
- struct i2c_client *power;
+ struct i2c_client *power = NULL;
static u8 pmic_i2c_addr;
if (pmic_id)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 117/846] media: aspeed: fix mode-detect always time out at 2nd run
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 116/846] media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr() Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 118/846] media: em28xx: fix memory leak in em28xx_init_dev Greg Kroah-Hartman
` (732 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jammy Huang, Paul Menzel,
Joel Stanley, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Jammy Huang <jammy_huang@aspeedtech.com>
[ Upstream commit 62cea52ad4bead0ae4be2cfe1142eb0aae0e9fbd ]
aspeed_video_get_resolution() will try to do res-detect again if the
timing got in last try is invalid. But it will always time out because
VE_SEQ_CTRL_TRIG_MODE_DET is only cleared after 1st mode-detect.
To fix the problem, just clear VE_SEQ_CTRL_TRIG_MODE_DET before setting
it in aspeed_video_enable_mode_detect().
Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/aspeed-video.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
index 7bb6babdcade0..23c41c545c536 100644
--- a/drivers/media/platform/aspeed-video.c
+++ b/drivers/media/platform/aspeed-video.c
@@ -500,6 +500,10 @@ static void aspeed_video_enable_mode_detect(struct aspeed_video *video)
aspeed_video_update(video, VE_INTERRUPT_CTRL, 0,
VE_INTERRUPT_MODE_DETECT);
+ /* Disable mode detect in order to re-trigger */
+ aspeed_video_update(video, VE_SEQ_CTRL,
+ VE_SEQ_CTRL_TRIG_MODE_DET, 0);
+
/* Trigger mode detect */
aspeed_video_update(video, VE_SEQ_CTRL, 0, VE_SEQ_CTRL_TRIG_MODE_DET);
}
@@ -786,10 +790,6 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
return;
}
- /* Disable mode detect in order to re-trigger */
- aspeed_video_update(video, VE_SEQ_CTRL,
- VE_SEQ_CTRL_TRIG_MODE_DET, 0);
-
aspeed_video_check_and_set_polarity(video);
aspeed_video_enable_mode_detect(video);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 118/846] media: em28xx: fix memory leak in em28xx_init_dev
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 117/846] media: aspeed: fix mode-detect always time out at 2nd run Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 119/846] media: aspeed: Update signal status immediately to ensure sane hw state Greg Kroah-Hartman
` (731 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Dongliang Mu,
syzkaller, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Dongliang Mu <mudongliangabcd@gmail.com>
[ Upstream commit 22be5a10d0b24eec9e45decd15d7e6112b25f080 ]
In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails
to deallocate the media_dev allocated in the em28xx_media_device_init.
Fix this by adding em28xx_unregister_media_device to free media_dev.
BTW, this patch is tested in my local syzkaller instance, and it can
prevent the memory leak from occurring again.
CC: Pavel Skripkin <paskripkin@gmail.com>
Fixes: 37ecc7b1278f ("[media] em28xx: add media controller support")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-cards.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 948e22e29b42a..ebc430b05f21c 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3625,8 +3625,10 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
if (dev->is_audio_only) {
retval = em28xx_audio_setup(dev);
- if (retval)
- return -ENODEV;
+ if (retval) {
+ retval = -ENODEV;
+ goto err_deinit_media;
+ }
em28xx_init_extension(dev);
return 0;
@@ -3645,7 +3647,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
dev_err(&dev->intf->dev,
"%s: em28xx_i2c_register bus 0 - error [%d]!\n",
__func__, retval);
- return retval;
+ goto err_deinit_media;
}
/* register i2c bus 1 */
@@ -3661,9 +3663,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
"%s: em28xx_i2c_register bus 1 - error [%d]!\n",
__func__, retval);
- em28xx_i2c_unregister(dev, 0);
-
- return retval;
+ goto err_unreg_i2c;
}
}
@@ -3671,6 +3671,12 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
em28xx_card_setup(dev);
return 0;
+
+err_unreg_i2c:
+ em28xx_i2c_unregister(dev, 0);
+err_deinit_media:
+ em28xx_unregister_media_device(dev);
+ return retval;
}
static int em28xx_duplicate_dev(struct em28xx *dev)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 119/846] media: aspeed: Update signal status immediately to ensure sane hw state
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 118/846] media: em28xx: fix memory leak in em28xx_init_dev Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 120/846] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name Greg Kroah-Hartman
` (730 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jammy Huang, Paul Menzel,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Jammy Huang <jammy_huang@aspeedtech.com>
[ Upstream commit af6d1bde395cac174ee71adcd3fa43f6435c7206 ]
If res-chg, VE_INTERRUPT_MODE_DETECT_WD irq will be raised. But
v4l2_input_status won't be updated to no-signal immediately until
aspeed_video_get_resolution() in aspeed_video_resolution_work().
During the period of time, aspeed_video_start_frame() could be called
because it doesn't know signal becomes unstable now. If it goes with
aspeed_video_init_regs() of aspeed_video_irq_res_change()
simultaneously, it will mess up hw state.
To fix this problem, v4l2_input_status is updated to no-signal
immediately for VE_INTERRUPT_MODE_DETECT_WD irq.
Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/aspeed-video.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
index 23c41c545c536..debc7509c173c 100644
--- a/drivers/media/platform/aspeed-video.c
+++ b/drivers/media/platform/aspeed-video.c
@@ -556,6 +556,8 @@ static void aspeed_video_irq_res_change(struct aspeed_video *video, ulong delay)
set_bit(VIDEO_RES_CHANGE, &video->flags);
clear_bit(VIDEO_FRAME_INPRG, &video->flags);
+ video->v4l2_input_status = V4L2_IN_ST_NO_SIGNAL;
+
aspeed_video_off(video);
aspeed_video_bufs_done(video, VB2_BUF_STATE_ERROR);
@@ -1337,7 +1339,6 @@ static void aspeed_video_resolution_work(struct work_struct *work)
struct delayed_work *dwork = to_delayed_work(work);
struct aspeed_video *video = container_of(dwork, struct aspeed_video,
res_work);
- u32 input_status = video->v4l2_input_status;
aspeed_video_on(video);
@@ -1350,8 +1351,7 @@ static void aspeed_video_resolution_work(struct work_struct *work)
aspeed_video_get_resolution(video);
if (video->detected_timings.width != video->active_timings.width ||
- video->detected_timings.height != video->active_timings.height ||
- input_status != video->v4l2_input_status) {
+ video->detected_timings.height != video->active_timings.height) {
static const struct v4l2_event ev = {
.type = V4L2_EVENT_SOURCE_CHANGE,
.u.src_change.changes = V4L2_EVENT_SRC_CH_RESOLUTION,
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 120/846] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 119/846] media: aspeed: Update signal status immediately to ensure sane hw state Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 121/846] arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+ Greg Kroah-Hartman
` (729 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Alexander Stein, Sasha Levin
From: Alexander Stein <alexander.stein@mailbox.org>
[ Upstream commit bb98a6fd0b0e227cefb2ba91cea2b55455f203b7 ]
Starting with commit 94274f20f6bf ("dt-bindings: opp: Convert to DT
schema") the opp node name has a mandatory pattern. This change
fixes the dtbs_check warning:
gpu-opp-table: $nodename:0: 'gpu-opp-table' does not match
'^opp-table(-[a-z0-9]+)?$'
Put the 'gpu' part at the end to match the pattern.
Fixes: 916a0edc43f0 ("arm64: dts: amlogic: meson-g12: add the Mali OPP table and use DVFS")
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Alexander Stein <alexander.stein@mailbox.org>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20211026182813.900775-2-alexander.stein@mailbox.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
index 00c6f53290d43..428449d98c0ae 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
@@ -58,7 +58,7 @@
secure-monitor = <&sm>;
};
- gpu_opp_table: gpu-opp-table {
+ gpu_opp_table: opp-table-gpu {
compatible = "operating-points-v2";
opp-124999998 {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 121/846] arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 120/846] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:33 ` [PATCH 5.15 122/846] arm64: dts: meson-gxbb-wetek: fix HDMI in early boot Greg Kroah-Hartman
` (728 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Alexander Stein, Sasha Levin
From: Alexander Stein <alexander.stein@mailbox.org>
[ Upstream commit 95d35256b564aca33fb661eac77dc94bfcffc8df ]
Fix the schema warning: "spi-flash@0: $nodename:0: 'spi-flash@0' does
not match '^flash(@.*)?$'" from jedec,spi-nor.yaml
Fixes: a084eaf3096c ("arm64: dts: meson-g12b-odroid-n2: add SPIFC controller node")
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Alexander Stein <alexander.stein@mailbox.org>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20211026182813.900775-3-alexander.stein@mailbox.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
index 4f33820aba1f1..a84ed3578425e 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
@@ -607,7 +607,7 @@
pinctrl-0 = <&nor_pins>;
pinctrl-names = "default";
- mx25u64: spi-flash@0 {
+ mx25u64: flash@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "mxicy,mx25u6435f", "jedec,spi-nor";
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 122/846] arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 121/846] arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+ Greg Kroah-Hartman
@ 2022-01-24 18:33 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 123/846] arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Greg Kroah-Hartman
` (727 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Hewitt, Neil Armstrong,
Sasha Levin
From: Christian Hewitt <christianshewitt@gmail.com>
[ Upstream commit 8182a35868db5f053111d5d9d4da8fcb3f99259d ]
Mark the VDDIO_AO18 regulator always-on and set hdmi-supply for the hdmi_tx
node to ensure HDMI is powered in the early stages of boot.
Fixes: fb72c03e0e32 ("ARM64: dts: meson-gxbb-wetek: add a wetek specific dtsi to cleanup hub and play2")
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20211012052522.30873-2-christianshewitt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index a350fee1264d7..8e2af986cebaf 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -64,6 +64,7 @@
regulator-name = "VDDIO_AO18";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
+ regulator-always-on;
};
vcc_3v3: regulator-vcc_3v3 {
@@ -161,6 +162,7 @@
status = "okay";
pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
pinctrl-names = "default";
+ hdmi-supply = <&vddio_ao18>;
};
&hdmi_tx_tmds_port {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 123/846] arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2022-01-24 18:33 ` [PATCH 5.15 122/846] arm64: dts: meson-gxbb-wetek: fix HDMI in early boot Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 124/846] fs: dlm: dont call kernel_getpeername() in error_report() Greg Kroah-Hartman
` (726 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Hewitt, Neil Armstrong,
Sasha Levin
From: Christian Hewitt <christianshewitt@gmail.com>
[ Upstream commit c019abb2feba3cbbd7cf7178f8e6499c4fa6fced ]
The absence of this binding appears to be harmless in Linux but it breaks
Ethernet support in mainline u-boot. So add the binding (which is present
in all other u-boot supported GXBB device-trees).
Fixes: fb72c03e0e32 ("ARM64: dts: meson-gxbb-wetek: add a wetek specific dtsi to cleanup hub and play2")
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20211012052522.30873-3-christianshewitt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index 8e2af986cebaf..a4d34398da358 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -6,6 +6,7 @@
*/
#include "meson-gxbb.dtsi"
+#include <dt-bindings/gpio/gpio.h>
/ {
aliases {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 124/846] fs: dlm: dont call kernel_getpeername() in error_report()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 123/846] arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 125/846] memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails Greg Kroah-Hartman
` (725 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bob Peterson, Alexander Aring,
David Teigland, Sasha Levin
From: Alexander Aring <aahringo@redhat.com>
[ Upstream commit 4c3d90570bcc2b338f70f61f01110268e281ca3c ]
In some cases kernel_getpeername() will held the socket lock which is
already held when the socket layer calls error_report() callback. Since
commit 9dfc685e0262 ("inet: remove races in inet{6}_getname()") this
problem becomes more likely because the socket lock will be held always.
You will see something like:
bob9-u5 login: [ 562.316860] BUG: spinlock recursion on CPU#7, swapper/7/0
[ 562.318562] lock: 0xffff8f2284720088, .magic: dead4ead, .owner: swapper/7/0, .owner_cpu: 7
[ 562.319522] CPU: 7 PID: 0 Comm: swapper/7 Not tainted 5.15.0+ #135
[ 562.320346] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014
[ 562.321277] Call Trace:
[ 562.321529] <IRQ>
[ 562.321734] dump_stack_lvl+0x33/0x42
[ 562.322282] do_raw_spin_lock+0x8b/0xc0
[ 562.322674] lock_sock_nested+0x1e/0x50
[ 562.323057] inet_getname+0x39/0x110
[ 562.323425] ? sock_def_readable+0x80/0x80
[ 562.323838] lowcomms_error_report+0x63/0x260 [dlm]
[ 562.324338] ? wait_for_completion_interruptible_timeout+0xd2/0x120
[ 562.324949] ? lock_timer_base+0x67/0x80
[ 562.325330] ? do_raw_spin_unlock+0x49/0xc0
[ 562.325735] ? _raw_spin_unlock_irqrestore+0x1e/0x40
[ 562.326218] ? del_timer+0x54/0x80
[ 562.326549] sk_error_report+0x12/0x70
[ 562.326919] tcp_validate_incoming+0x3c8/0x530
[ 562.327347] ? kvm_clock_read+0x14/0x30
[ 562.327718] ? ktime_get+0x3b/0xa0
[ 562.328055] tcp_rcv_established+0x121/0x660
[ 562.328466] tcp_v4_do_rcv+0x132/0x260
[ 562.328835] tcp_v4_rcv+0xcea/0xe20
[ 562.329173] ip_protocol_deliver_rcu+0x35/0x1f0
[ 562.329615] ip_local_deliver_finish+0x54/0x60
[ 562.330050] ip_local_deliver+0xf7/0x110
[ 562.330431] ? inet_rtm_getroute+0x211/0x840
[ 562.330848] ? ip_protocol_deliver_rcu+0x1f0/0x1f0
[ 562.331310] ip_rcv+0xe1/0xf0
[ 562.331603] ? ip_local_deliver+0x110/0x110
[ 562.332011] __netif_receive_skb_core+0x46a/0x1040
[ 562.332476] ? inet_gro_receive+0x263/0x2e0
[ 562.332885] __netif_receive_skb_list_core+0x13b/0x2c0
[ 562.333383] netif_receive_skb_list_internal+0x1c8/0x2f0
[ 562.333896] ? update_load_avg+0x7e/0x5e0
[ 562.334285] gro_normal_list.part.149+0x19/0x40
[ 562.334722] napi_complete_done+0x67/0x160
[ 562.335134] virtnet_poll+0x2ad/0x408 [virtio_net]
[ 562.335644] __napi_poll+0x28/0x140
[ 562.336012] net_rx_action+0x23d/0x300
[ 562.336414] __do_softirq+0xf2/0x2ea
[ 562.336803] irq_exit_rcu+0xc1/0xf0
[ 562.337173] common_interrupt+0xb9/0xd0
It is and was always forbidden to call kernel_getpeername() in context
of error_report(). To get rid of the problem we access the destination
address for the peer over the socket structure. While on it we fix to
print out the destination port of the inet socket.
Fixes: 1a31833d085a ("DLM: Replace nodeid_to_addr with kernel_getpeername")
Reported-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/lowcomms.c | 42 ++++++++++++++++++++----------------------
1 file changed, 20 insertions(+), 22 deletions(-)
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 8f715c620e1f8..7b1c5f05a988b 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -592,8 +592,8 @@ int dlm_lowcomms_nodes_set_mark(int nodeid, unsigned int mark)
static void lowcomms_error_report(struct sock *sk)
{
struct connection *con;
- struct sockaddr_storage saddr;
void (*orig_report)(struct sock *) = NULL;
+ struct inet_sock *inet;
read_lock_bh(&sk->sk_callback_lock);
con = sock2con(sk);
@@ -601,33 +601,31 @@ static void lowcomms_error_report(struct sock *sk)
goto out;
orig_report = listen_sock.sk_error_report;
- if (kernel_getpeername(sk->sk_socket, (struct sockaddr *)&saddr) < 0) {
- printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
- "sending to node %d, port %d, "
- "sk_err=%d/%d\n", dlm_our_nodeid(),
- con->nodeid, dlm_config.ci_tcp_port,
- sk->sk_err, sk->sk_err_soft);
- } else if (saddr.ss_family == AF_INET) {
- struct sockaddr_in *sin4 = (struct sockaddr_in *)&saddr;
+ inet = inet_sk(sk);
+ switch (sk->sk_family) {
+ case AF_INET:
printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
- "sending to node %d at %pI4, port %d, "
+ "sending to node %d at %pI4, dport %d, "
"sk_err=%d/%d\n", dlm_our_nodeid(),
- con->nodeid, &sin4->sin_addr.s_addr,
- dlm_config.ci_tcp_port, sk->sk_err,
+ con->nodeid, &inet->inet_daddr,
+ ntohs(inet->inet_dport), sk->sk_err,
sk->sk_err_soft);
- } else {
- struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&saddr;
-
+ break;
+ case AF_INET6:
printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
- "sending to node %d at %u.%u.%u.%u, "
- "port %d, sk_err=%d/%d\n", dlm_our_nodeid(),
- con->nodeid, sin6->sin6_addr.s6_addr32[0],
- sin6->sin6_addr.s6_addr32[1],
- sin6->sin6_addr.s6_addr32[2],
- sin6->sin6_addr.s6_addr32[3],
- dlm_config.ci_tcp_port, sk->sk_err,
+ "sending to node %d at %pI6c, "
+ "dport %d, sk_err=%d/%d\n", dlm_our_nodeid(),
+ con->nodeid, &sk->sk_v6_daddr,
+ ntohs(inet->inet_dport), sk->sk_err,
sk->sk_err_soft);
+ break;
+ default:
+ printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
+ "invalid socket family %d set, "
+ "sk_err=%d/%d\n", dlm_our_nodeid(),
+ sk->sk_family, sk->sk_err, sk->sk_err_soft);
+ goto out;
}
/* below sendcon only handling */
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 125/846] memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 124/846] fs: dlm: dont call kernel_getpeername() in error_report() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 126/846] Bluetooth: stop proccessing malicious adv data Greg Kroah-Hartman
` (724 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Biju Das,
Wolfram Sang, Geert Uytterhoeven, Krzysztof Kozlowski,
Sasha Levin
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 818fdfa89baac77a8df5a2c30f4fb798cc937aa0 ]
Make sure we return error in case devm_ioremap_resource() fails for dirmap
resource.
Fixes: ca7d8b980b67 ("memory: add Renesas RPC-IF driver")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20211025205631.21151-6-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/renesas-rpc-if.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c
index 77a011d5ff8c1..8618702233002 100644
--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -244,7 +244,7 @@ int rpcif_sw_init(struct rpcif *rpc, struct device *dev)
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dirmap");
rpc->dirmap = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(rpc->dirmap))
- rpc->dirmap = NULL;
+ return PTR_ERR(rpc->dirmap);
rpc->size = resource_size(res);
rpc->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 126/846] Bluetooth: stop proccessing malicious adv data
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 125/846] memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 127/846] ath11k: Fix ETSI regd with weather radar overlap Greg Kroah-Hartman
` (723 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Marcel Holtmann,
Sasha Levin, syzbot+e3fcb9c4f3c2a931dc40
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ]
Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The
problem was in missing validaion check.
We should check if data is not malicious and we can read next data block.
If we won't check ptr validness, code can read a way beyond skb->end and
it can cause problems, of course.
Fixes: e95beb414168 ("Bluetooth: hci_le_adv_report_evt code refactoring")
Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 0bca035bf2dcc..50d1d62c15ec8 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5780,7 +5780,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
struct hci_ev_le_advertising_info *ev = ptr;
s8 rssi;
- if (ev->length <= HCI_MAX_AD_LENGTH) {
+ if (ev->length <= HCI_MAX_AD_LENGTH &&
+ ev->data + ev->length <= skb_tail_pointer(skb)) {
rssi = ev->data[ev->length];
process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
ev->bdaddr_type, NULL, 0, rssi,
@@ -5790,6 +5791,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
}
ptr += sizeof(*ev) + ev->length + 1;
+
+ if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) {
+ bt_dev_err(hdev, "Malicious advertising data. Stopping processing");
+ break;
+ }
}
hci_dev_unlock(hdev);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 127/846] ath11k: Fix ETSI regd with weather radar overlap
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 126/846] Bluetooth: stop proccessing malicious adv data Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 128/846] ath11k: clear the keys properly via DISABLE_KEY Greg Kroah-Hartman
` (722 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
From: Sven Eckelmann <sven@narfation.org>
[ Upstream commit 086c921a354089f209318501038d43c98d3f409f ]
Some ETSI countries have a small overlap in the wireless-regdb with an ETSI
channel (5590-5650). A good example is Australia:
country AU: DFS-ETSI
(2400 - 2483.5 @ 40), (36)
(5150 - 5250 @ 80), (23), NO-OUTDOOR, AUTO-BW
(5250 - 5350 @ 80), (20), NO-OUTDOOR, AUTO-BW, DFS
(5470 - 5600 @ 80), (27), DFS
(5650 - 5730 @ 80), (27), DFS
(5730 - 5850 @ 80), (36)
(57000 - 66000 @ 2160), (43), NO-OUTDOOR
If the firmware (or the BDF) is shipped with these rules then there is only
a 10 MHz overlap with the weather radar:
* below: 5470 - 5590
* weather radar: 5590 - 5600
* above: (none for the rule "5470 - 5600 @ 80")
There are several wrong assumption in the ath11k code:
* there is always a valid range below the weather radar
(actually: there could be no range below the weather radar range OR range
could be smaller than 20 MHz)
* intersected range in the weather radar range is valid
(actually: the range could be smaller than 20 MHz)
* range above weather radar is either empty or valid
(actually: the range could be smaller than 20 MHz)
These wrong assumption will lead in this example to a rule
(5590 - 5600 @ 20), (N/A, 27), (600000 ms), DFS, AUTO-BW
which is invalid according to is_valid_reg_rule() because the freq_diff is
only 10 MHz but the max_bandwidth is set to 20 MHz. Which results in a
rejection like:
WARNING: at backports-20210222_001-4.4.60-b157d2276/net/wireless/reg.c:3984
[...]
Call trace:
[<ffffffbffc3d2e50>] reg_get_max_bandwidth+0x300/0x3a8 [cfg80211]
[<ffffffbffc3d3d0c>] regulatory_set_wiphy_regd_sync+0x3c/0x98 [cfg80211]
[<ffffffbffc651598>] ath11k_regd_update+0x1a8/0x210 [ath11k]
[<ffffffbffc652108>] ath11k_regd_update_work+0x18/0x20 [ath11k]
[<ffffffc0000a93e0>] process_one_work+0x1f8/0x340
[<ffffffc0000a9784>] worker_thread+0x25c/0x448
[<ffffffc0000aedc8>] kthread+0xd0/0xd8
[<ffffffc000085550>] ret_from_fork+0x10/0x40
ath11k c000000.wifi: failed to perform regd update : -22
Invalid regulatory domain detected
To avoid this, the algorithm has to be changed slightly. Instead of
splitting a rule which overlaps with the weather radar range into 3 pieces
and accepting the first two parts blindly, it must actually be checked for
each piece whether it is a valid range. And only if it is valid, add it to
the output array.
When these checks are in place, the processed rules for AU would end up as
country AU: DFS-ETSI
(2400 - 2483 @ 40), (N/A, 36), (N/A)
(5150 - 5250 @ 80), (6, 23), (N/A), NO-OUTDOOR, AUTO-BW
(5250 - 5350 @ 80), (6, 20), (0 ms), NO-OUTDOOR, DFS, AUTO-BW
(5470 - 5590 @ 80), (6, 27), (0 ms), DFS, AUTO-BW
(5650 - 5730 @ 80), (6, 27), (0 ms), DFS, AUTO-BW
(5730 - 5850 @ 80), (6, 36), (N/A), AUTO-BW
and will be accepted by the wireless regulatory code.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211112153116.1214421-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/reg.c | 103 ++++++++++++++------------
1 file changed, 56 insertions(+), 47 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index 92c59009a8ac2..f793324ad0b73 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -459,6 +459,9 @@ ath11k_reg_adjust_bw(u16 start_freq, u16 end_freq, u16 max_bw)
{
u16 bw;
+ if (end_freq <= start_freq)
+ return 0;
+
bw = end_freq - start_freq;
bw = min_t(u16, bw, max_bw);
@@ -466,8 +469,10 @@ ath11k_reg_adjust_bw(u16 start_freq, u16 end_freq, u16 max_bw)
bw = 80;
else if (bw >= 40 && bw < 80)
bw = 40;
- else if (bw < 40)
+ else if (bw >= 20 && bw < 40)
bw = 20;
+ else
+ bw = 0;
return bw;
}
@@ -491,73 +496,77 @@ ath11k_reg_update_weather_radar_band(struct ath11k_base *ab,
struct cur_reg_rule *reg_rule,
u8 *rule_idx, u32 flags, u16 max_bw)
{
+ u32 start_freq;
u32 end_freq;
u16 bw;
u8 i;
i = *rule_idx;
+ /* there might be situations when even the input rule must be dropped */
+ i--;
+
+ /* frequencies below weather radar */
bw = ath11k_reg_adjust_bw(reg_rule->start_freq,
ETSI_WEATHER_RADAR_BAND_LOW, max_bw);
+ if (bw > 0) {
+ i++;
- ath11k_reg_update_rule(regd->reg_rules + i, reg_rule->start_freq,
- ETSI_WEATHER_RADAR_BAND_LOW, bw,
- reg_rule->ant_gain, reg_rule->reg_power,
- flags);
+ ath11k_reg_update_rule(regd->reg_rules + i,
+ reg_rule->start_freq,
+ ETSI_WEATHER_RADAR_BAND_LOW, bw,
+ reg_rule->ant_gain, reg_rule->reg_power,
+ flags);
- ath11k_dbg(ab, ATH11K_DBG_REG,
- "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
- i + 1, reg_rule->start_freq, ETSI_WEATHER_RADAR_BAND_LOW,
- bw, reg_rule->ant_gain, reg_rule->reg_power,
- regd->reg_rules[i].dfs_cac_ms,
- flags);
-
- if (reg_rule->end_freq > ETSI_WEATHER_RADAR_BAND_HIGH)
- end_freq = ETSI_WEATHER_RADAR_BAND_HIGH;
- else
- end_freq = reg_rule->end_freq;
+ ath11k_dbg(ab, ATH11K_DBG_REG,
+ "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+ i + 1, reg_rule->start_freq,
+ ETSI_WEATHER_RADAR_BAND_LOW, bw, reg_rule->ant_gain,
+ reg_rule->reg_power, regd->reg_rules[i].dfs_cac_ms,
+ flags);
+ }
- bw = ath11k_reg_adjust_bw(ETSI_WEATHER_RADAR_BAND_LOW, end_freq,
- max_bw);
+ /* weather radar frequencies */
+ start_freq = max_t(u32, reg_rule->start_freq,
+ ETSI_WEATHER_RADAR_BAND_LOW);
+ end_freq = min_t(u32, reg_rule->end_freq, ETSI_WEATHER_RADAR_BAND_HIGH);
- i++;
+ bw = ath11k_reg_adjust_bw(start_freq, end_freq, max_bw);
+ if (bw > 0) {
+ i++;
- ath11k_reg_update_rule(regd->reg_rules + i,
- ETSI_WEATHER_RADAR_BAND_LOW, end_freq, bw,
- reg_rule->ant_gain, reg_rule->reg_power,
- flags);
+ ath11k_reg_update_rule(regd->reg_rules + i, start_freq,
+ end_freq, bw, reg_rule->ant_gain,
+ reg_rule->reg_power, flags);
- regd->reg_rules[i].dfs_cac_ms = ETSI_WEATHER_RADAR_BAND_CAC_TIMEOUT;
+ regd->reg_rules[i].dfs_cac_ms = ETSI_WEATHER_RADAR_BAND_CAC_TIMEOUT;
- ath11k_dbg(ab, ATH11K_DBG_REG,
- "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
- i + 1, ETSI_WEATHER_RADAR_BAND_LOW, end_freq,
- bw, reg_rule->ant_gain, reg_rule->reg_power,
- regd->reg_rules[i].dfs_cac_ms,
- flags);
-
- if (end_freq == reg_rule->end_freq) {
- regd->n_reg_rules--;
- *rule_idx = i;
- return;
+ ath11k_dbg(ab, ATH11K_DBG_REG,
+ "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+ i + 1, start_freq, end_freq, bw,
+ reg_rule->ant_gain, reg_rule->reg_power,
+ regd->reg_rules[i].dfs_cac_ms, flags);
}
+ /* frequencies above weather radar */
bw = ath11k_reg_adjust_bw(ETSI_WEATHER_RADAR_BAND_HIGH,
reg_rule->end_freq, max_bw);
+ if (bw > 0) {
+ i++;
- i++;
-
- ath11k_reg_update_rule(regd->reg_rules + i, ETSI_WEATHER_RADAR_BAND_HIGH,
- reg_rule->end_freq, bw,
- reg_rule->ant_gain, reg_rule->reg_power,
- flags);
+ ath11k_reg_update_rule(regd->reg_rules + i,
+ ETSI_WEATHER_RADAR_BAND_HIGH,
+ reg_rule->end_freq, bw,
+ reg_rule->ant_gain, reg_rule->reg_power,
+ flags);
- ath11k_dbg(ab, ATH11K_DBG_REG,
- "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
- i + 1, ETSI_WEATHER_RADAR_BAND_HIGH, reg_rule->end_freq,
- bw, reg_rule->ant_gain, reg_rule->reg_power,
- regd->reg_rules[i].dfs_cac_ms,
- flags);
+ ath11k_dbg(ab, ATH11K_DBG_REG,
+ "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+ i + 1, ETSI_WEATHER_RADAR_BAND_HIGH,
+ reg_rule->end_freq, bw, reg_rule->ant_gain,
+ reg_rule->reg_power, regd->reg_rules[i].dfs_cac_ms,
+ flags);
+ }
*rule_idx = i;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 128/846] ath11k: clear the keys properly via DISABLE_KEY
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 127/846] ath11k: Fix ETSI regd with weather radar overlap Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 129/846] ath11k: reset RSN/WPA present state for open BSS Greg Kroah-Hartman
` (721 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann,
Karthikeyan Kathirvel, Kalle Valo, Sasha Levin
From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
[ Upstream commit 436a4e88659842a7cf634d7cc088c8f2cc94ebf5 ]
DISABLE_KEY sets the key_len to 0, firmware will not delete the keys if
key_len is 0. Changing from security mode to open mode will cause mcast
to be still encrypted without vdev restart.
Set the proper key_len for DISABLE_KEY cmd to clear the keys in
firmware.
Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
[sven@narfation.org: split into separate patches, clean up commit message]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211115100441.33771-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/mac.c | 4 +---
drivers/net/wireless/ath/ath11k/wmi.c | 3 ++-
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 89a64ebd620f3..aac10740f5752 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -2655,9 +2655,7 @@ static int ath11k_install_key(struct ath11k_vif *arvif,
return 0;
if (cmd == DISABLE_KEY) {
- /* TODO: Check if FW expects value other than NONE for del */
- /* arg.key_cipher = WMI_CIPHER_NONE; */
- arg.key_len = 0;
+ arg.key_cipher = WMI_CIPHER_NONE;
arg.key_data = NULL;
goto install;
}
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index c22ec921b2e97..e75e6ebdf2a65 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -1671,7 +1671,8 @@ int ath11k_wmi_vdev_install_key(struct ath11k *ar,
tlv = (struct wmi_tlv *)(skb->data + sizeof(*cmd));
tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_BYTE) |
FIELD_PREP(WMI_TLV_LEN, key_len_aligned);
- memcpy(tlv->value, (u8 *)arg->key_data, key_len_aligned);
+ if (arg->key_data)
+ memcpy(tlv->value, (u8 *)arg->key_data, key_len_aligned);
ret = ath11k_wmi_cmd_send(wmi, skb, WMI_VDEV_INSTALL_KEY_CMDID);
if (ret) {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 129/846] ath11k: reset RSN/WPA present state for open BSS
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 128/846] ath11k: clear the keys properly via DISABLE_KEY Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 130/846] spi: hisi-kunpeng: Fix the debugfs directory name incorrect Greg Kroah-Hartman
` (720 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Venkateswara Naralasetty,
Sven Eckelmann, Karthikeyan Kathirvel, Kalle Valo, Sasha Levin
From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
[ Upstream commit 64bc3aa02ae78b1fcb1b850e0eb1f0622002bfaa ]
The ath11k driver is caching the information about RSN/WPA IE in the
configured beacon template. The cached information is used during
associations to figure out whether 4-way PKT/2-way GTK peer flags need to
be set or not.
But the code never cleared the state when no such IE was found. This can
for example happen when moving from an WPA/RSN to an open setup. The
(seemingly connected) peer was then not able to communicate over the
link because the firmware assumed a different (encryption enabled) state
for the peer.
Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
Fixes: 01e34233c645 ("ath11k: fix wmi peer flags in peer assoc command")
Cc: Venkateswara Naralasetty <vnaralas@codeaurora.org>
Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
[sven@narfation.org: split into separate patches, clean up commit message]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211115100441.33771-2-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/mac.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index aac10740f5752..2df60c74809d3 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -767,11 +767,15 @@ static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
if (cfg80211_find_ie(WLAN_EID_RSN, ies, (skb_tail_pointer(bcn) - ies)))
arvif->rsnie_present = true;
+ else
+ arvif->rsnie_present = false;
if (cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
WLAN_OUI_TYPE_MICROSOFT_WPA,
ies, (skb_tail_pointer(bcn) - ies)))
arvif->wpaie_present = true;
+ else
+ arvif->wpaie_present = false;
ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 130/846] spi: hisi-kunpeng: Fix the debugfs directory name incorrect
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 129/846] ath11k: reset RSN/WPA present state for open BSS Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 131/846] tee: fix put order in teedev_close_context() Greg Kroah-Hartman
` (719 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, oujiefeng, Jay Fang, Mark Brown, Sasha Levin
From: oujiefeng <oujiefeng@huawei.com>
[ Upstream commit 40fafc8eca3f0d41b9dade5c10afb2dad723aad7 ]
Change the debugfs directory name from hisi_spi65535 to hisi_spi0.
Fixes: 2b2142f247eb ("spi: hisi-kunpeng: Add debugfs support")
Signed-off-by: oujiefeng <oujiefeng@huawei.com>
Signed-off-by: Jay Fang <f.fangjian@huawei.com>
Link: https://lore.kernel.org/r/20211117012119.55558-1-f.fangjian@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-hisi-kunpeng.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/spi/spi-hisi-kunpeng.c b/drivers/spi/spi-hisi-kunpeng.c
index 58b823a16fc4d..525cc0143a305 100644
--- a/drivers/spi/spi-hisi-kunpeng.c
+++ b/drivers/spi/spi-hisi-kunpeng.c
@@ -127,7 +127,6 @@ struct hisi_spi {
void __iomem *regs;
int irq;
u32 fifo_len; /* depth of the FIFO buffer */
- u16 bus_num;
/* Current message transfer state info */
const void *tx;
@@ -165,7 +164,10 @@ static int hisi_spi_debugfs_init(struct hisi_spi *hs)
{
char name[32];
- snprintf(name, 32, "hisi_spi%d", hs->bus_num);
+ struct spi_controller *master;
+
+ master = container_of(hs->dev, struct spi_controller, dev);
+ snprintf(name, 32, "hisi_spi%d", master->bus_num);
hs->debugfs = debugfs_create_dir(name, NULL);
if (!hs->debugfs)
return -ENOMEM;
@@ -467,7 +469,6 @@ static int hisi_spi_probe(struct platform_device *pdev)
hs = spi_controller_get_devdata(master);
hs->dev = dev;
hs->irq = irq;
- hs->bus_num = pdev->id;
hs->regs = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(hs->regs))
@@ -490,7 +491,7 @@ static int hisi_spi_probe(struct platform_device *pdev)
master->use_gpio_descriptors = true;
master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 32);
- master->bus_num = hs->bus_num;
+ master->bus_num = pdev->id;
master->setup = hisi_spi_setup;
master->cleanup = hisi_spi_cleanup;
master->transfer_one = hisi_spi_transfer_one;
@@ -506,15 +507,15 @@ static int hisi_spi_probe(struct platform_device *pdev)
return ret;
}
- if (hisi_spi_debugfs_init(hs))
- dev_info(dev, "failed to create debugfs dir\n");
-
ret = spi_register_controller(master);
if (ret) {
dev_err(dev, "failed to register spi master, ret=%d\n", ret);
return ret;
}
+ if (hisi_spi_debugfs_init(hs))
+ dev_info(dev, "failed to create debugfs dir\n");
+
dev_info(dev, "hw version:0x%x max-freq:%u kHz\n",
readl(hs->regs + HISI_SPI_VERSION),
master->max_speed_hz / 1000);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 131/846] tee: fix put order in teedev_close_context()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 130/846] spi: hisi-kunpeng: Fix the debugfs directory name incorrect Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 132/846] fs: dlm: fix build with CONFIG_IPV6 disabled Greg Kroah-Hartman
` (718 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sumit Garg, Jens Wiklander, Sasha Levin
From: Jens Wiklander <jens.wiklander@linaro.org>
[ Upstream commit f18397ab3ae23e8e43bba9986e66af6d4497f2ad ]
Prior to this patch was teedev_close_context() calling tee_device_put()
before teedev_ctx_put() leading to teedev_ctx_release() accessing
ctx->teedev just after the reference counter was decreased on the
teedev. Fix this by calling teedev_ctx_put() before tee_device_put().
Fixes: 217e0250cccb ("tee: use reference counting for tee_context")
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tee/tee_core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index 2b37bc408fc3d..85102d12d7169 100644
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -98,8 +98,10 @@ void teedev_ctx_put(struct tee_context *ctx)
static void teedev_close_context(struct tee_context *ctx)
{
- tee_device_put(ctx->teedev);
+ struct tee_device *teedev = ctx->teedev;
+
teedev_ctx_put(ctx);
+ tee_device_put(teedev);
}
static int tee_open(struct inode *inode, struct file *filp)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 132/846] fs: dlm: fix build with CONFIG_IPV6 disabled
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 131/846] tee: fix put order in teedev_close_context() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 133/846] drm/dp: Dont read back backlight mode in drm_edp_backlight_enable() Greg Kroah-Hartman
` (717 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Alexander Aring,
David Teigland, Sasha Levin
From: Alexander Aring <aahringo@redhat.com>
[ Upstream commit 1b9beda83e27a0c2cd75d1cb743c297c7b36c844 ]
This patch will surround the AF_INET6 case in sk_error_report() of dlm
with a #if IS_ENABLED(CONFIG_IPV6). The field sk->sk_v6_daddr is not
defined when CONFIG_IPV6 is disabled. If CONFIG_IPV6 is disabled, the
socket creation with AF_INET6 should already fail because a runtime
check if AF_INET6 is registered. However if there is the possibility
that AF_INET6 is set as sk_family the sk_error_report() callback will
print then an invalid family type error.
Reported-by: kernel test robot <lkp@intel.com>
Fixes: 4c3d90570bcc ("fs: dlm: don't call kernel_getpeername() in error_report()")
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/lowcomms.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 7b1c5f05a988b..7a8efce1c343e 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -612,6 +612,7 @@ static void lowcomms_error_report(struct sock *sk)
ntohs(inet->inet_dport), sk->sk_err,
sk->sk_err_soft);
break;
+#if IS_ENABLED(CONFIG_IPV6)
case AF_INET6:
printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
"sending to node %d at %pI6c, "
@@ -620,6 +621,7 @@ static void lowcomms_error_report(struct sock *sk)
ntohs(inet->inet_dport), sk->sk_err,
sk->sk_err_soft);
break;
+#endif
default:
printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
"invalid socket family %d set, "
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 133/846] drm/dp: Dont read back backlight mode in drm_edp_backlight_enable()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 132/846] fs: dlm: fix build with CONFIG_IPV6 disabled Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 134/846] drm/vboxvideo: fix a NULL vs IS_ERR() check Greg Kroah-Hartman
` (716 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lyude Paul, Douglas Anderson, Sasha Levin
From: Lyude Paul <lyude@redhat.com>
[ Upstream commit 646596485e1ed2182adf293dfd5aec4a96c46330 ]
As it turns out, apparently some machines will actually leave additional
backlight functionality like dynamic backlight control on before the OS
loads. Currently we don't take care to disable unsupported features when
writing back the backlight mode, which can lead to some rather strange
looking behavior when adjusting the backlight.
So, let's fix this by just not reading back the current backlight mode on
initial enable. I don't think there should really be any downsides to this,
and this will ensure we don't leave any unsupported functionality enabled.
This should fix at least one (but not all) of the issues seen with DPCD
backlight support on fi-bdw-samus
v5:
* Just avoid reading back DPCD register - Doug Anderson
Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: 867cf9cd73c3 ("drm/dp: Extract i915's eDP backlight code into DRM helpers")
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211105183342.130810-4-lyude@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_dp_helper.c | 40 ++++++++++-----------------------
1 file changed, 12 insertions(+), 28 deletions(-)
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 6d0f2c447f3b9..7bb24523a7493 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -3214,27 +3214,13 @@ int drm_edp_backlight_enable(struct drm_dp_aux *aux, const struct drm_edp_backli
const u16 level)
{
int ret;
- u8 dpcd_buf, new_dpcd_buf;
+ u8 dpcd_buf = DP_EDP_BACKLIGHT_CONTROL_MODE_DPCD;
- ret = drm_dp_dpcd_readb(aux, DP_EDP_BACKLIGHT_MODE_SET_REGISTER, &dpcd_buf);
- if (ret != 1) {
- drm_dbg_kms(aux->drm_dev,
- "%s: Failed to read backlight mode: %d\n", aux->name, ret);
- return ret < 0 ? ret : -EIO;
- }
-
- new_dpcd_buf = dpcd_buf;
-
- if ((dpcd_buf & DP_EDP_BACKLIGHT_CONTROL_MODE_MASK) != DP_EDP_BACKLIGHT_CONTROL_MODE_DPCD) {
- new_dpcd_buf &= ~DP_EDP_BACKLIGHT_CONTROL_MODE_MASK;
- new_dpcd_buf |= DP_EDP_BACKLIGHT_CONTROL_MODE_DPCD;
-
- if (bl->pwmgen_bit_count) {
- ret = drm_dp_dpcd_writeb(aux, DP_EDP_PWMGEN_BIT_COUNT, bl->pwmgen_bit_count);
- if (ret != 1)
- drm_dbg_kms(aux->drm_dev, "%s: Failed to write aux pwmgen bit count: %d\n",
- aux->name, ret);
- }
+ if (bl->pwmgen_bit_count) {
+ ret = drm_dp_dpcd_writeb(aux, DP_EDP_PWMGEN_BIT_COUNT, bl->pwmgen_bit_count);
+ if (ret != 1)
+ drm_dbg_kms(aux->drm_dev, "%s: Failed to write aux pwmgen bit count: %d\n",
+ aux->name, ret);
}
if (bl->pwm_freq_pre_divider) {
@@ -3244,16 +3230,14 @@ int drm_edp_backlight_enable(struct drm_dp_aux *aux, const struct drm_edp_backli
"%s: Failed to write aux backlight frequency: %d\n",
aux->name, ret);
else
- new_dpcd_buf |= DP_EDP_BACKLIGHT_FREQ_AUX_SET_ENABLE;
+ dpcd_buf |= DP_EDP_BACKLIGHT_FREQ_AUX_SET_ENABLE;
}
- if (new_dpcd_buf != dpcd_buf) {
- ret = drm_dp_dpcd_writeb(aux, DP_EDP_BACKLIGHT_MODE_SET_REGISTER, new_dpcd_buf);
- if (ret != 1) {
- drm_dbg_kms(aux->drm_dev, "%s: Failed to write aux backlight mode: %d\n",
- aux->name, ret);
- return ret < 0 ? ret : -EIO;
- }
+ ret = drm_dp_dpcd_writeb(aux, DP_EDP_BACKLIGHT_MODE_SET_REGISTER, dpcd_buf);
+ if (ret != 1) {
+ drm_dbg_kms(aux->drm_dev, "%s: Failed to write aux backlight mode: %d\n",
+ aux->name, ret);
+ return ret < 0 ? ret : -EIO;
}
ret = drm_edp_backlight_set_level(aux, bl, level);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 134/846] drm/vboxvideo: fix a NULL vs IS_ERR() check
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 133/846] drm/dp: Dont read back backlight mode in drm_edp_backlight_enable() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 135/846] arm64: dts: renesas: cat875: Add rx/tx delays Greg Kroah-Hartman
` (715 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans de Goede, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit cebbb5c46d0cb0615fd0c62dea9b44273d0a9780 ]
The devm_gen_pool_create() function never returns NULL, it returns
error pointers.
Fixes: 4cc9b565454b ("drm/vboxvideo: Use devm_gen_pool_create")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211118111233.GA1147@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vboxvideo/vbox_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vboxvideo/vbox_main.c b/drivers/gpu/drm/vboxvideo/vbox_main.c
index f28779715ccda..c9e8b3a63c621 100644
--- a/drivers/gpu/drm/vboxvideo/vbox_main.c
+++ b/drivers/gpu/drm/vboxvideo/vbox_main.c
@@ -127,8 +127,8 @@ int vbox_hw_init(struct vbox_private *vbox)
/* Create guest-heap mem-pool use 2^4 = 16 byte chunks */
vbox->guest_pool = devm_gen_pool_create(vbox->ddev.dev, 4, -1,
"vboxvideo-accel");
- if (!vbox->guest_pool)
- return -ENOMEM;
+ if (IS_ERR(vbox->guest_pool))
+ return PTR_ERR(vbox->guest_pool);
ret = gen_pool_add_virt(vbox->guest_pool,
(unsigned long)vbox->guest_heap,
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 135/846] arm64: dts: renesas: cat875: Add rx/tx delays
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 134/846] drm/vboxvideo: fix a NULL vs IS_ERR() check Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 136/846] media: dmxdev: fix UAF when dvb_register_device() fails Greg Kroah-Hartman
` (714 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Biju Das, Geert Uytterhoeven, Sasha Levin
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit e1a9faddffe7e555304dc2e3284c84fbee0679ee ]
The CAT875 sub board from Silicon Linux uses a Realtek PHY.
The phy driver commit bbc4d71d63549bcd003 ("net: phy: realtek: fix
rtl8211e rx/tx delay config") introduced NFS mount failures. Now it
needs both rx/tx delays for the NFS mount to work.
This patch fixes the NFS mount failure issue by adding "rgmii-id" mode
to the avb device node.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Fixes: bbc4d71d63549bcd ("net: phy: realtek: fix rtl8211e rx/tx delay config")
Link: https://lore.kernel.org/r/20211115142830.12651-1-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/renesas/cat875.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/renesas/cat875.dtsi b/arch/arm64/boot/dts/renesas/cat875.dtsi
index 801ea54b027c4..20f8adc635e72 100644
--- a/arch/arm64/boot/dts/renesas/cat875.dtsi
+++ b/arch/arm64/boot/dts/renesas/cat875.dtsi
@@ -18,6 +18,7 @@
pinctrl-names = "default";
renesas,no-ether-link;
phy-handle = <&phy0>;
+ phy-mode = "rgmii-id";
status = "okay";
phy0: ethernet-phy@0 {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 136/846] media: dmxdev: fix UAF when dvb_register_device() fails
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 135/846] arm64: dts: renesas: cat875: Add rx/tx delays Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 137/846] crypto: atmel-aes - Reestablish the correct tfm context at dequeue Greg Kroah-Hartman
` (713 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai,
Mauro Carvalho Chehab, Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit ab599eb11882f834951c436cc080c3455ba32b9b ]
I got a use-after-free report:
dvbdev: dvb_register_device: failed to create device dvb1.dvr0 (-12)
...
==================================================================
BUG: KASAN: use-after-free in dvb_dmxdev_release+0xce/0x2f0
...
Call Trace:
dump_stack_lvl+0x6c/0x8b
print_address_description.constprop.0+0x48/0x70
kasan_report.cold+0x82/0xdb
__asan_load4+0x6b/0x90
dvb_dmxdev_release+0xce/0x2f0
...
Allocated by task 7666:
kasan_save_stack+0x23/0x50
__kasan_kmalloc+0x83/0xa0
kmem_cache_alloc_trace+0x22e/0x470
dvb_register_device+0x12f/0x980
dvb_dmxdev_init+0x1f3/0x230
...
Freed by task 7666:
kasan_save_stack+0x23/0x50
kasan_set_track+0x20/0x30
kasan_set_free_info+0x24/0x40
__kasan_slab_free+0xf2/0x130
kfree+0xd1/0x5c0
dvb_register_device.cold+0x1ac/0x1fa
dvb_dmxdev_init+0x1f3/0x230
...
When dvb_register_device() in dvb_dmxdev_init() fails, dvb_dmxdev_init()
does not return a failure, and the memory pointed to by dvbdev or
dvr_dvbdev is invalid at this point. If they are used subsequently, it
will result in UFA or null-ptr-deref.
If dvb_register_device() in dvb_dmxdev_init() fails, fix the bug by making
dvb_dmxdev_init() return an error as well.
Link: https://lore.kernel.org/linux-media/20211015085741.1203283-1-wanghai38@huawei.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dmxdev.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 5d5a48475a54f..01f288fa37e0e 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -1413,7 +1413,7 @@ static const struct dvb_device dvbdev_dvr = {
};
int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter)
{
- int i;
+ int i, ret;
if (dmxdev->demux->open(dmxdev->demux) < 0)
return -EUSERS;
@@ -1432,14 +1432,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter)
DMXDEV_STATE_FREE);
}
- dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev,
+ ret = dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev,
DVB_DEVICE_DEMUX, dmxdev->filternum);
- dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr,
+ if (ret < 0)
+ goto err_register_dvbdev;
+
+ ret = dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr,
dmxdev, DVB_DEVICE_DVR, dmxdev->filternum);
+ if (ret < 0)
+ goto err_register_dvr_dvbdev;
dvb_ringbuffer_init(&dmxdev->dvr_buffer, NULL, 8192);
return 0;
+
+err_register_dvr_dvbdev:
+ dvb_unregister_device(dmxdev->dvbdev);
+err_register_dvbdev:
+ vfree(dmxdev->filter);
+ dmxdev->filter = NULL;
+ return ret;
}
EXPORT_SYMBOL(dvb_dmxdev_init);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 137/846] crypto: atmel-aes - Reestablish the correct tfm context at dequeue
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 136/846] media: dmxdev: fix UAF when dvb_register_device() fails Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 138/846] crypto: qce - fix uaf on qce_aead_register_one Greg Kroah-Hartman
` (712 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wolfgang Ocker, Tudor Ambarus,
Herbert Xu, Sasha Levin
From: Tudor Ambarus <tudor.ambarus@microchip.com>
[ Upstream commit 6d48de655917a9d782953eba65de4e3db593ddf0 ]
In case there were more requests from different tfms in the crypto
queue, only the context of the last initialized tfm was considered.
Fixes: ec2088b66f7a ("crypto: atmel-aes - Allocate aes dev at tfm init time")
Reported-by: Wolfgang Ocker <weo@reccoware.de>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-aes.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
index 9391ccc03382d..fe05584031914 100644
--- a/drivers/crypto/atmel-aes.c
+++ b/drivers/crypto/atmel-aes.c
@@ -960,6 +960,7 @@ static int atmel_aes_handle_queue(struct atmel_aes_dev *dd,
ctx = crypto_tfm_ctx(areq->tfm);
dd->areq = areq;
+ dd->ctx = ctx;
start_async = (areq != new_areq);
dd->is_async = start_async;
@@ -1274,7 +1275,6 @@ static int atmel_aes_init_tfm(struct crypto_skcipher *tfm)
crypto_skcipher_set_reqsize(tfm, sizeof(struct atmel_aes_reqctx));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_start;
return 0;
@@ -1291,7 +1291,6 @@ static int atmel_aes_ctr_init_tfm(struct crypto_skcipher *tfm)
crypto_skcipher_set_reqsize(tfm, sizeof(struct atmel_aes_reqctx));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_ctr_start;
return 0;
@@ -1783,7 +1782,6 @@ static int atmel_aes_gcm_init(struct crypto_aead *tfm)
crypto_aead_set_reqsize(tfm, sizeof(struct atmel_aes_reqctx));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_gcm_start;
return 0;
@@ -1927,7 +1925,6 @@ static int atmel_aes_xts_init_tfm(struct crypto_skcipher *tfm)
crypto_skcipher_set_reqsize(tfm, sizeof(struct atmel_aes_reqctx) +
crypto_skcipher_reqsize(ctx->fallback_tfm));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_xts_start;
return 0;
@@ -2154,7 +2151,6 @@ static int atmel_aes_authenc_init_tfm(struct crypto_aead *tfm,
crypto_aead_set_reqsize(tfm, (sizeof(struct atmel_aes_authenc_reqctx) +
auth_reqsize));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_authenc_start;
return 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 138/846] crypto: qce - fix uaf on qce_aead_register_one
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 137/846] crypto: atmel-aes - Reestablish the correct tfm context at dequeue Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 139/846] crypto: qce - fix uaf on qce_ahash_register_one Greg Kroah-Hartman
` (711 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Thara Gopinath,
Herbert Xu, Sasha Levin
From: Chengfeng Ye <cyeaa@connect.ust.hk>
[ Upstream commit 4a9dbd021970ffe1b92521328377b699acba7c52 ]
Pointer alg points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing alg before free tmpl.
Fixes: 9363efb4 ("crypto: qce - Add support for AEAD algorithms")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qce/aead.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
index 290e2446a2f35..97a530171f07a 100644
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -802,8 +802,8 @@ static int qce_aead_register_one(const struct qce_aead_def *def, struct qce_devi
ret = crypto_register_aead(alg);
if (ret) {
- kfree(tmpl);
dev_err(qce->dev, "%s registration failed\n", alg->base.cra_name);
+ kfree(tmpl);
return ret;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 139/846] crypto: qce - fix uaf on qce_ahash_register_one
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 138/846] crypto: qce - fix uaf on qce_aead_register_one Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 140/846] crypto: qce - fix uaf on qce_skcipher_register_one Greg Kroah-Hartman
` (710 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Thara Gopinath,
Herbert Xu, Sasha Levin
From: Chengfeng Ye <cyeaa@connect.ust.hk>
[ Upstream commit b4cb4d31631912842eb7dce02b4350cbb7562d5e ]
Pointer base points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing base before free tmpl.
Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qce/sha.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
index 8e6fcf2c21cc0..59159f5e64e52 100644
--- a/drivers/crypto/qce/sha.c
+++ b/drivers/crypto/qce/sha.c
@@ -498,8 +498,8 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def,
ret = crypto_register_ahash(alg);
if (ret) {
- kfree(tmpl);
dev_err(qce->dev, "%s registration failed\n", base->cra_name);
+ kfree(tmpl);
return ret;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 140/846] crypto: qce - fix uaf on qce_skcipher_register_one
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 139/846] crypto: qce - fix uaf on qce_ahash_register_one Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 141/846] arm64: dts: qcom: sc7280: Fix incorrect clock name Greg Kroah-Hartman
` (709 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Thara Gopinath,
Herbert Xu, Sasha Levin
From: Chengfeng Ye <cyeaa@connect.ust.hk>
[ Upstream commit e9c195aaeed1b45c9012adbe29dedb6031e85aa8 ]
Pointer alg points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing alg before free tmpl.
Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qce/skcipher.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
index 8ff10928f581d..3d27cd5210ef5 100644
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -484,8 +484,8 @@ static int qce_skcipher_register_one(const struct qce_skcipher_def *def,
ret = crypto_register_skcipher(alg);
if (ret) {
- kfree(tmpl);
dev_err(qce->dev, "%s registration failed\n", alg->base.cra_name);
+ kfree(tmpl);
return ret;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 141/846] arm64: dts: qcom: sc7280: Fix incorrect clock name
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 140/846] crypto: qce - fix uaf on qce_skcipher_register_one Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 142/846] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove Greg Kroah-Hartman
` (708 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Prasad Malisetty, Stephen Boyd,
Bjorn Andersson, Sasha Levin
From: Prasad Malisetty <pmaliset@codeaurora.org>
[ Upstream commit fa09b2248714c64644576d8064e9bd292a504a0e ]
Replace pcie_1_pipe-clk clock name with pcie_1_pipe_clk
To match with dt binding.
Fixes: ab7772de8612 ("arm64: dts: qcom: SC7280: Add rpmhcc clock controller node")
Signed-off-by: Prasad Malisetty <pmaliset@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/1637060508-30375-2-git-send-email-pmaliset@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
index f58336536a92a..692973c4f4344 100644
--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -429,7 +429,7 @@
<&rpmhcc RPMH_CXO_CLK_A>, <&sleep_clk>,
<0>, <0>, <0>, <0>, <0>, <0>;
clock-names = "bi_tcxo", "bi_tcxo_ao", "sleep_clk",
- "pcie_0_pipe_clk", "pcie_1_pipe-clk",
+ "pcie_0_pipe_clk", "pcie_1_pipe_clk",
"ufs_phy_rx_symbol_0_clk", "ufs_phy_rx_symbol_1_clk",
"ufs_phy_tx_symbol_0_clk",
"usb3_phy_wrapper_gcc_usb30_pipe_clk";
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 142/846] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 141/846] arm64: dts: qcom: sc7280: Fix incorrect clock name Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 143/846] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure Greg Kroah-Hartman
` (707 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, George G. Davis, Vignesh Raghavendra,
Sasha Levin
From: George G. Davis <davis.george@siemens.com>
[ Upstream commit baaf965f94308301d2dc554d72a87d7432cd5ce6 ]
The following KASAN BUG is observed when testing the rpc-if driver on
rcar-gen3:
root@rcar-gen3:~# modprobe -r rpc-if
[ 101.930146] ==================================================================
[ 101.937408] BUG: KASAN: slab-out-of-bounds in __lock_acquire+0x518/0x25d0
[ 101.944240] Read of size 8 at addr ffff0004c5be2750 by task modprobe/664
[ 101.950959]
[ 101.952466] CPU: 2 PID: 664 Comm: modprobe Not tainted 5.14.0-rc1-00342-g1a1464d7aa31 #1
[ 101.960578] Hardware name: Renesas H3ULCB board based on r8a77951 (DT)
[ 101.967120] Call trace:
[ 101.969580] dump_backtrace+0x0/0x2c0
[ 101.973275] show_stack+0x1c/0x30
[ 101.976616] dump_stack_lvl+0x9c/0xd8
[ 101.980301] print_address_description.constprop.0+0x74/0x2b8
[ 101.986071] kasan_report+0x1f4/0x26c
[ 101.989757] __asan_load8+0x98/0xd4
[ 101.993266] __lock_acquire+0x518/0x25d0
[ 101.997215] lock_acquire.part.0+0x18c/0x360
[ 102.001506] lock_acquire+0x74/0x90
[ 102.005013] _raw_spin_lock_irq+0x98/0x130
[ 102.009131] __pm_runtime_disable+0x30/0x210
[ 102.013427] rpcif_hb_remove+0x5c/0x70 [rpc_if]
[ 102.018001] platform_remove+0x40/0x80
[ 102.021771] __device_release_driver+0x234/0x350
[ 102.026412] driver_detach+0x158/0x20c
[ 102.030179] bus_remove_driver+0xa0/0x140
[ 102.034212] driver_unregister+0x48/0x80
[ 102.038153] platform_driver_unregister+0x18/0x24
[ 102.042879] rpcif_platform_driver_exit+0x1c/0x34 [rpc_if]
[ 102.048400] __arm64_sys_delete_module+0x210/0x310
[ 102.053212] invoke_syscall+0x60/0x190
[ 102.056986] el0_svc_common+0x12c/0x144
[ 102.060844] do_el0_svc+0x88/0xac
[ 102.064181] el0_svc+0x24/0x3c
[ 102.067257] el0t_64_sync_handler+0x1a8/0x1b0
[ 102.071634] el0t_64_sync+0x198/0x19c
[ 102.075315]
[ 102.076815] Allocated by task 628:
[ 102.080781]
[ 102.082280] Last potentially related work creation:
[ 102.087524]
[ 102.089022] The buggy address belongs to the object at ffff0004c5be2000
[ 102.089022] which belongs to the cache kmalloc-2k of size 2048
[ 102.101555] The buggy address is located 1872 bytes inside of
[ 102.101555] 2048-byte region [ffff0004c5be2000, ffff0004c5be2800)
[ 102.113486] The buggy address belongs to the page:
[ 102.118409]
[ 102.119908] Memory state around the buggy address:
[ 102.124711] ffff0004c5be2600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.131947] ffff0004c5be2680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.139181] >ffff0004c5be2700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.146412] ^
[ 102.152257] ffff0004c5be2780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.159491] ffff0004c5be2800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.166723] ==================================================================
The above bug is caused by use of the wrong pointer in the
rpcif_disable_rpm() call. Fix the bug by using the correct pointer.
Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
Signed-off-by: George G. Davis <davis.george@siemens.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Link: https://lore.kernel.org/r/20210716204935.25859-1-george_davis@mentor.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/hyperbus/rpc-if.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
index 367b0d72bf622..dc164c18f8429 100644
--- a/drivers/mtd/hyperbus/rpc-if.c
+++ b/drivers/mtd/hyperbus/rpc-if.c
@@ -152,9 +152,9 @@ static int rpcif_hb_remove(struct platform_device *pdev)
{
struct rpcif_hyperbus *hyperbus = platform_get_drvdata(pdev);
int error = hyperbus_unregister_device(&hyperbus->hbdev);
- struct rpcif *rpc = dev_get_drvdata(pdev->dev.parent);
- rpcif_disable_rpm(rpc);
+ rpcif_disable_rpm(&hyperbus->rpc);
+
return error;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 143/846] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 142/846] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 144/846] cpufreq: qcom-hw: Fix probable nested interrupt handling Greg Kroah-Hartman
` (706 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thara Gopinath, Lukasz Luba,
Viresh Kumar, Sasha Levin
From: Lukasz Luba <lukasz.luba@arm.com>
[ Upstream commit 93d9e6f93e1586fcc97498c764be2e8c8401f4bd ]
The thermal pressure signal gives information to the scheduler about
reduced CPU capacity due to thermal. It is based on a value stored in
a per-cpu 'thermal_pressure' variable. The online CPUs will get the
new value there, while the offline won't. Unfortunately, when the CPU
is back online, the value read from per-cpu variable might be wrong
(stale data). This might affect the scheduler decisions, since it
sees the CPU capacity differently than what is actually available.
Fix it by making sure that all online+offline CPUs would get the
proper value in their per-cpu variable when there is throttling
or throttling is removed.
Fixes: 275157b367f479 ("cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support")
Reviewed-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/qcom-cpufreq-hw.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
index a2be0df7e1747..0138b2ec406dc 100644
--- a/drivers/cpufreq/qcom-cpufreq-hw.c
+++ b/drivers/cpufreq/qcom-cpufreq-hw.c
@@ -304,7 +304,8 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data)
if (capacity > max_capacity)
capacity = max_capacity;
- arch_set_thermal_pressure(policy->cpus, max_capacity - capacity);
+ arch_set_thermal_pressure(policy->related_cpus,
+ max_capacity - capacity);
/*
* In the unlikely case policy is unregistered do not enable
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 144/846] cpufreq: qcom-hw: Fix probable nested interrupt handling
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 143/846] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 145/846] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco Greg Kroah-Hartman
` (705 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy,
Matthias Kaehlcke, Bjorn Andersson, Viresh Kumar, Sasha Levin
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
[ Upstream commit e0e27c3d4e20dab861566f1c348ae44e4b498630 ]
Re-enabling an interrupt from its own interrupt handler may cause
an interrupt storm, if there is a pending interrupt and because its
handling is disabled due to already done entrance into the handler
above in the stack.
Also, apparently it is improper to lock a mutex in an interrupt contex.
Fixes: 275157b367f4 ("cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support")
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/qcom-cpufreq-hw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
index 0138b2ec406dc..35d93361fda1a 100644
--- a/drivers/cpufreq/qcom-cpufreq-hw.c
+++ b/drivers/cpufreq/qcom-cpufreq-hw.c
@@ -343,9 +343,9 @@ static irqreturn_t qcom_lmh_dcvs_handle_irq(int irq, void *data)
/* Disable interrupt and enable polling */
disable_irq_nosync(c_data->throttle_irq);
- qcom_lmh_dcvs_notify(c_data);
+ schedule_delayed_work(&c_data->throttle_work, 0);
- return 0;
+ return IRQ_HANDLED;
}
static const struct qcom_cpufreq_soc_data qcom_soc_data = {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 145/846] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 144/846] cpufreq: qcom-hw: Fix probable nested interrupt handling Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 146/846] libbpf: Fix potential misaligned memory access in btf_ext__new() Greg Kroah-Hartman
` (704 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dillon Min, kernel test robot,
Linus Walleij, Alexandre Torgue, Sasha Levin
From: Dillon Min <dillon.minfei@gmail.com>
[ Upstream commit b046049e59dca5e5830dc75ed16acf7657a95161 ]
Since the compatible string defined from ilitek,ili9341.yaml is
"st,sf-tc240t-9370-t", "ilitek,ili9341"
so, append "ilitek,ili9341" to avoid the below dtbs_check warning.
arch/arm/boot/dts/stm32f429-disco.dt.yaml: display@1: compatible:
['st,sf-tc240t-9370-t'] is too short
Fixes: a726e2f000ec ("ARM: dts: stm32: enable ltdc binding with ili9341, gyro l3gd20 on stm32429-disco board")
Signed-off-by: Dillon Min <dillon.minfei@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/stm32f429-disco.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/stm32f429-disco.dts b/arch/arm/boot/dts/stm32f429-disco.dts
index 075ac57d0bf4a..6435e099c6326 100644
--- a/arch/arm/boot/dts/stm32f429-disco.dts
+++ b/arch/arm/boot/dts/stm32f429-disco.dts
@@ -192,7 +192,7 @@
display: display@1{
/* Connect panel-ilitek-9341 to ltdc */
- compatible = "st,sf-tc240t-9370-t";
+ compatible = "st,sf-tc240t-9370-t", "ilitek,ili9341";
reg = <1>;
spi-3wire;
spi-max-frequency = <10000000>;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 146/846] libbpf: Fix potential misaligned memory access in btf_ext__new()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 145/846] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 147/846] libbpf: Fix glob_syms memory leak in bpf_linker Greg Kroah-Hartman
` (703 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Evgeny Vereshchagin, Andrii Nakryiko,
Daniel Borkmann, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 401891a9debaf0a684502f2aaecf53448cee9414 ]
Perform a memory copy before we do the sanity checks of btf_ext_hdr.
This prevents misaligned memory access if raw btf_ext data is not 4-byte
aligned ([0]).
While at it, also add missing const qualifier.
[0] Closes: https://github.com/libbpf/libbpf/issues/391
Fixes: 2993e0515bb4 ("tools/bpf: add support to read .BTF.ext sections")
Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211124002325.1737739-3-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/btf.c | 10 +++++-----
tools/lib/bpf/btf.h | 2 +-
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 1b9341ef638b0..5fa64a7f0dda8 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -2626,15 +2626,11 @@ void btf_ext__free(struct btf_ext *btf_ext)
free(btf_ext);
}
-struct btf_ext *btf_ext__new(__u8 *data, __u32 size)
+struct btf_ext *btf_ext__new(const __u8 *data, __u32 size)
{
struct btf_ext *btf_ext;
int err;
- err = btf_ext_parse_hdr(data, size);
- if (err)
- return libbpf_err_ptr(err);
-
btf_ext = calloc(1, sizeof(struct btf_ext));
if (!btf_ext)
return libbpf_err_ptr(-ENOMEM);
@@ -2647,6 +2643,10 @@ struct btf_ext *btf_ext__new(__u8 *data, __u32 size)
}
memcpy(btf_ext->data, data, size);
+ err = btf_ext_parse_hdr(btf_ext->data, size);
+ if (err)
+ goto done;
+
if (btf_ext->hdr->hdr_len < offsetofend(struct btf_ext_header, line_info_len)) {
err = -EINVAL;
goto done;
diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h
index 4a711f990904b..b0ee338a0cc87 100644
--- a/tools/lib/bpf/btf.h
+++ b/tools/lib/bpf/btf.h
@@ -80,7 +80,7 @@ LIBBPF_API int btf__get_map_kv_tids(const struct btf *btf, const char *map_name,
__u32 expected_value_size,
__u32 *key_type_id, __u32 *value_type_id);
-LIBBPF_API struct btf_ext *btf_ext__new(__u8 *data, __u32 size);
+LIBBPF_API struct btf_ext *btf_ext__new(const __u8 *data, __u32 size);
LIBBPF_API void btf_ext__free(struct btf_ext *btf_ext);
LIBBPF_API const void *btf_ext__get_raw_data(const struct btf_ext *btf_ext,
__u32 *size);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 147/846] libbpf: Fix glob_syms memory leak in bpf_linker
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 146/846] libbpf: Fix potential misaligned memory access in btf_ext__new() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 148/846] libbpf: Fix using invalidated memory " Greg Kroah-Hartman
` (702 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Daniel Borkmann,
Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 8cb125566c40b7141d8842c534f0ea5820ee3d5c ]
glob_syms array wasn't freed on bpf_link__free(). Fix that.
Fixes: a46349227cd8 ("libbpf: Add linker extern resolution support for functions and global variables")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211124002325.1737739-6-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/linker.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
index 2df880cefdaee..84095a2c2ef2a 100644
--- a/tools/lib/bpf/linker.c
+++ b/tools/lib/bpf/linker.c
@@ -211,6 +211,7 @@ void bpf_linker__free(struct bpf_linker *linker)
}
free(linker->secs);
+ free(linker->glob_syms);
free(linker);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 148/846] libbpf: Fix using invalidated memory in bpf_linker
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 147/846] libbpf: Fix glob_syms memory leak in bpf_linker Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 149/846] crypto: qat - remove unnecessary collision prevention step in PFVF Greg Kroah-Hartman
` (701 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Daniel Borkmann,
Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 593835377f24ca1bb98008ec1dc3baefe491ad6e ]
add_dst_sec() can invalidate bpf_linker's section index making
dst_symtab pointer pointing into unallocated memory. Reinitialize
dst_symtab pointer on each iteration to make sure it's always valid.
Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211124002325.1737739-7-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/linker.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
index 84095a2c2ef2a..6b2f59ddb6918 100644
--- a/tools/lib/bpf/linker.c
+++ b/tools/lib/bpf/linker.c
@@ -2001,7 +2001,7 @@ add_sym:
static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *obj)
{
struct src_sec *src_symtab = &obj->secs[obj->symtab_sec_idx];
- struct dst_sec *dst_symtab = &linker->secs[linker->symtab_sec_idx];
+ struct dst_sec *dst_symtab;
int i, err;
for (i = 1; i < obj->sec_cnt; i++) {
@@ -2034,6 +2034,9 @@ static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *ob
return -1;
}
+ /* add_dst_sec() above could have invalidated linker->secs */
+ dst_symtab = &linker->secs[linker->symtab_sec_idx];
+
/* shdr->sh_link points to SYMTAB */
dst_sec->shdr->sh_link = linker->symtab_sec_idx;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 149/846] crypto: qat - remove unnecessary collision prevention step in PFVF
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 148/846] libbpf: Fix using invalidated memory " Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 150/846] crypto: qat - make pfvf send message direction agnostic Greg Kroah-Hartman
` (700 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marco Chiappero, Giovanni Cabiddu,
Herbert Xu, Sasha Levin
From: Marco Chiappero <marco.chiappero@intel.com>
[ Upstream commit e17f49bb244a281fe39bfdad0306a38b3a02e7bf ]
The initial version of the PFVF protocol included an initial "carrier
sensing" to get ownership of the channel.
Collisions can happen anyway, the extra wait and test does not prevent
collisions, it instead slows the communication down, so remove it.
Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 20 +------------------
1 file changed, 1 insertion(+), 19 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index 5a41beb8f20f6..d3f6ff68d45d9 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -126,28 +126,10 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
goto out;
}
- /* Attempt to get ownership of PF2VF CSR */
msg &= ~local_in_use_mask;
msg |= local_in_use_pattern;
- ADF_CSR_WR(pmisc_bar_addr, pf2vf_offset, msg);
- /* Wait in case remote func also attempting to get ownership */
- msleep(ADF_IOV_MSG_COLLISION_DETECT_DELAY);
-
- val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset);
- if ((val & local_in_use_mask) != local_in_use_pattern) {
- dev_dbg(&GET_DEV(accel_dev),
- "PF2VF CSR in use by remote - collision detected\n");
- ret = -EBUSY;
- goto out;
- }
-
- /*
- * This function now owns the PV2VF CSR. The IN_USE_BY pattern must
- * remain in the PF2VF CSR for all writes including ACK from remote
- * until this local function relinquishes the CSR. Send the message
- * by interrupting the remote.
- */
+ /* Attempt to get ownership of the PF2VF CSR */
ADF_CSR_WR(pmisc_bar_addr, pf2vf_offset, msg | int_bit);
/* Wait for confirmation from remote func it received the message */
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 150/846] crypto: qat - make pfvf send message direction agnostic
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 149/846] crypto: qat - remove unnecessary collision prevention step in PFVF Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 151/846] crypto: qat - fix undetected PFVF timeout in ACK loop Greg Kroah-Hartman
` (699 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marco Chiappero, Giovanni Cabiddu,
Herbert Xu, Sasha Levin
From: Marco Chiappero <marco.chiappero@intel.com>
[ Upstream commit 6e680f94bc31d0fd0ff01123c964d895ea8040fa ]
The functions adf_iov_putmsg() and __adf_iov_putmsg() are shared by both
PF and VF. Any logging or documentation should not refer to any specific
direction.
Make comments and log messages direction agnostic by replacing PF2VF
with PFVF. Also fix the wording for some related comments.
Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Co-developed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index d3f6ff68d45d9..d5a7261ddd928 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -117,11 +117,11 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
mutex_lock(lock);
- /* Check if PF2VF CSR is in use by remote function */
+ /* Check if the PFVF CSR is in use by remote function */
val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset);
if ((val & remote_in_use_mask) == remote_in_use_pattern) {
dev_dbg(&GET_DEV(accel_dev),
- "PF2VF CSR in use by remote function\n");
+ "PFVF CSR in use by remote function\n");
ret = -EBUSY;
goto out;
}
@@ -129,7 +129,7 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
msg &= ~local_in_use_mask;
msg |= local_in_use_pattern;
- /* Attempt to get ownership of the PF2VF CSR */
+ /* Attempt to get ownership of the PFVF CSR */
ADF_CSR_WR(pmisc_bar_addr, pf2vf_offset, msg | int_bit);
/* Wait for confirmation from remote func it received the message */
@@ -151,7 +151,7 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
ret = -EIO;
}
- /* Finished with PF2VF CSR; relinquish it and leave msg in CSR */
+ /* Finished with the PFVF CSR; relinquish it and leave msg in CSR */
ADF_CSR_WR(pmisc_bar_addr, pf2vf_offset, val & ~local_in_use_mask);
out:
mutex_unlock(lock);
@@ -159,12 +159,13 @@ out:
}
/**
- * adf_iov_putmsg() - send PF2VF message
+ * adf_iov_putmsg() - send PFVF message
* @accel_dev: Pointer to acceleration device.
* @msg: Message to send
- * @vf_nr: VF number to which the message will be sent
+ * @vf_nr: VF number to which the message will be sent if on PF, ignored
+ * otherwise
*
- * Function sends a message from the PF to a VF
+ * Function sends a message through the PFVF channel
*
* Return: 0 on success, error code otherwise.
*/
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 151/846] crypto: qat - fix undetected PFVF timeout in ACK loop
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 150/846] crypto: qat - make pfvf send message direction agnostic Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 152/846] ath11k: Use host CE parameters for CE interrupts configuration Greg Kroah-Hartman
` (698 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
Herbert Xu, Sasha Levin
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 5002200b4fedd7e90e4fbc2e5c42a4b3351df814 ]
If the remote function did not ACK the reception of a message, the
function __adf_iov_putmsg() could detect it as a collision.
This was due to the fact that the collision and the timeout checks after
the ACK loop were in the wrong order. The timeout must be checked at the
end of the loop, so fix by swapping the order of the two checks.
Fixes: 9b768e8a3909 ("crypto: qat - detect PFVF collision after ACK")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Co-developed-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index d5a7261ddd928..7ec81989beb03 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -138,6 +138,12 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset);
} while ((val & int_bit) && (count++ < ADF_IOV_MSG_ACK_MAX_RETRY));
+ if (val & int_bit) {
+ dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n");
+ val &= ~int_bit;
+ ret = -EIO;
+ }
+
if (val != msg) {
dev_dbg(&GET_DEV(accel_dev),
"Collision - PFVF CSR overwritten by remote function\n");
@@ -145,12 +151,6 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
goto out;
}
- if (val & int_bit) {
- dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n");
- val &= ~int_bit;
- ret = -EIO;
- }
-
/* Finished with the PFVF CSR; relinquish it and leave msg in CSR */
ADF_CSR_WR(pmisc_bar_addr, pf2vf_offset, val & ~local_in_use_mask);
out:
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 152/846] ath11k: Use host CE parameters for CE interrupts configuration
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 151/846] crypto: qat - fix undetected PFVF timeout in ACK loop Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 153/846] arm64: dts: ti: k3-j721e: correct cache-sets info Greg Kroah-Hartman
` (697 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anilkumar Kolli, Kalle Valo, Sasha Levin
From: Anilkumar Kolli <akolli@codeaurora.org>
[ Upstream commit b689f091aafd1a874b2f88137934276ab0fca480 ]
CE interrupt configuration uses host ce parameters to assign/free
interrupts. Use host ce parameters to enable/disable interrupts.
This patch fixes below BUG,
BUG: KASAN: global-out-of-bounds in 0xffffffbffdfb035c at addr
ffffffbffde6eeac
Read of size 4 by task kworker/u8:2/132
Address belongs to variable ath11k_core_qmi_firmware_ready+0x1b0/0x5bc [ath11k]
OOB is due to ath11k_ahb_ce_irqs_enable() iterates ce_count(which is 12)
times and accessing 12th element in target_ce_config
(which has only 11 elements) from ath11k_ahb_ce_irq_enable().
With this change host ce configs are used to enable/disable interrupts.
Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00471-QCAHKSWPL_SILICONZ-1
Fixes: 967c1d1131fa ("ath11k: move target ce configs to hw_params")
Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1637249558-12793-1-git-send-email-akolli@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/ahb.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
index 8c9c781afc3e5..096c502cce387 100644
--- a/drivers/net/wireless/ath/ath11k/ahb.c
+++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -206,13 +206,13 @@ static void ath11k_ahb_clearbit32(struct ath11k_base *ab, u8 bit, u32 offset)
static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)
{
- const struct ce_pipe_config *ce_config;
+ const struct ce_attr *ce_attr;
- ce_config = &ab->hw_params.target_ce_config[ce_id];
- if (__le32_to_cpu(ce_config->pipedir) & PIPEDIR_OUT)
+ ce_attr = &ab->hw_params.host_ce_config[ce_id];
+ if (ce_attr->src_nentries)
ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
- if (__le32_to_cpu(ce_config->pipedir) & PIPEDIR_IN) {
+ if (ce_attr->dest_nentries) {
ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
ath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
CE_HOST_IE_3_ADDRESS);
@@ -221,13 +221,13 @@ static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)
static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)
{
- const struct ce_pipe_config *ce_config;
+ const struct ce_attr *ce_attr;
- ce_config = &ab->hw_params.target_ce_config[ce_id];
- if (__le32_to_cpu(ce_config->pipedir) & PIPEDIR_OUT)
+ ce_attr = &ab->hw_params.host_ce_config[ce_id];
+ if (ce_attr->src_nentries)
ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
- if (__le32_to_cpu(ce_config->pipedir) & PIPEDIR_IN) {
+ if (ce_attr->dest_nentries) {
ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
ath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
CE_HOST_IE_3_ADDRESS);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 153/846] arm64: dts: ti: k3-j721e: correct cache-sets info
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 152/846] ath11k: Use host CE parameters for CE interrupts configuration Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 154/846] tty: serial: atmel: Check return code of dmaengine_submit() Greg Kroah-Hartman
` (696 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peng Fan, Nishanth Menon,
Vignesh Raghavendra, Sasha Levin
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 7a0df1f969c14939f60a7f9a6af72adcc314675f ]
A72 Cluster has 48KB Icache, 32KB Dcache and 1MB L2 Cache
- ICache is 3-way set-associative
- Dcache is 2-way set-associative
- Line size are 64bytes
So correct the cache-sets info.
Fixes: 2d87061e70dea ("arm64: dts: ti: Add Support for J721E SoC")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Link: https://lore.kernel.org/r/20211112063155.3485777-1-peng.fan@oss.nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-j721e.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-j721e.dtsi b/arch/arm64/boot/dts/ti/k3-j721e.dtsi
index f0587fde147e6..9f1d25d57a693 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721e.dtsi
@@ -61,7 +61,7 @@
i-cache-sets = <256>;
d-cache-size = <0x8000>;
d-cache-line-size = <64>;
- d-cache-sets = <128>;
+ d-cache-sets = <256>;
next-level-cache = <&L2_0>;
};
@@ -75,7 +75,7 @@
i-cache-sets = <256>;
d-cache-size = <0x8000>;
d-cache-line-size = <64>;
- d-cache-sets = <128>;
+ d-cache-sets = <256>;
next-level-cache = <&L2_0>;
};
};
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 154/846] tty: serial: atmel: Check return code of dmaengine_submit()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 153/846] arm64: dts: ti: k3-j721e: correct cache-sets info Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 155/846] tty: serial: atmel: Call dma_async_issue_pending() Greg Kroah-Hartman
` (695 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tudor Ambarus, Richard Genoud, Sasha Levin
From: Tudor Ambarus <tudor.ambarus@microchip.com>
[ Upstream commit 1e67bd2b8cb90b66e89562598e9c2046246832d3 ]
The tx_submit() method of struct dma_async_tx_descriptor is entitled
to do sanity checks and return errors if encountered. It's not the
case for the DMA controller drivers that this client is using
(at_h/xdmac), because they currently don't do sanity checks and always
return a positive cookie at tx_submit() method. In case the controller
drivers will implement sanity checks and return errors, print a message
so that the client will be informed that something went wrong at
tx_submit() level.
Fixes: 08f738be88bb ("serial: at91: add tx dma support")
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Acked-by: Richard Genoud <richard.genoud@gmail.com>
Link: https://lore.kernel.org/r/20211125090028.786832-3-tudor.ambarus@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/atmel_serial.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 249ea35088d27..16ff972decfef 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1004,6 +1004,11 @@ static void atmel_tx_dma(struct uart_port *port)
desc->callback = atmel_complete_tx_dma;
desc->callback_param = atmel_port;
atmel_port->cookie_tx = dmaengine_submit(desc);
+ if (dma_submit_error(atmel_port->cookie_tx)) {
+ dev_err(port->dev, "dma_submit_error %d\n",
+ atmel_port->cookie_tx);
+ return;
+ }
}
if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
@@ -1258,6 +1263,11 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
desc->callback_param = port;
atmel_port->desc_rx = desc;
atmel_port->cookie_rx = dmaengine_submit(desc);
+ if (dma_submit_error(atmel_port->cookie_rx)) {
+ dev_err(port->dev, "dma_submit_error %d\n",
+ atmel_port->cookie_rx);
+ goto chan_err;
+ }
return 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 155/846] tty: serial: atmel: Call dma_async_issue_pending()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 154/846] tty: serial: atmel: Check return code of dmaengine_submit() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 156/846] mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP Greg Kroah-Hartman
` (694 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tudor Ambarus, Sasha Levin
From: Tudor Ambarus <tudor.ambarus@microchip.com>
[ Upstream commit 4f4b9b5895614eb2e2b5f4cab7858f44bd113e1b ]
The driver wrongly assummed that tx_submit() will start the transfer,
which is not the case, now that the at_xdmac driver is fixed. tx_submit
is supposed to push the current transaction descriptor to a pending queue,
waiting for issue_pending to be called. issue_pending must start the
transfer, not tx_submit.
Fixes: 34df42f59a60 ("serial: at91: add rx dma support")
Fixes: 08f738be88bb ("serial: at91: add tx dma support")
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20211125090028.786832-4-tudor.ambarus@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/atmel_serial.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 16ff972decfef..dd350c5908804 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1009,6 +1009,8 @@ static void atmel_tx_dma(struct uart_port *port)
atmel_port->cookie_tx);
return;
}
+
+ dma_async_issue_pending(chan);
}
if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
@@ -1269,6 +1271,8 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
goto chan_err;
}
+ dma_async_issue_pending(atmel_port->chan_rx);
+
return 0;
chan_err:
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 156/846] mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 155/846] tty: serial: atmel: Call dma_async_issue_pending() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 157/846] mfd: atmel-flexcom: Use .resume_noirq Greg Kroah-Hartman
` (693 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Nicolas Ferre,
Lee Jones, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 8c0fad75dcaa650e3f3145a2c35847bc6a65cb7f ]
Remove compilation flag and use __maybe_unused and pm_ptr instead.
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20211028135138.3481166-2-claudiu.beznea@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/atmel-flexcom.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/mfd/atmel-flexcom.c b/drivers/mfd/atmel-flexcom.c
index d2f5c073fdf31..962f66dc8813e 100644
--- a/drivers/mfd/atmel-flexcom.c
+++ b/drivers/mfd/atmel-flexcom.c
@@ -87,8 +87,7 @@ static const struct of_device_id atmel_flexcom_of_match[] = {
};
MODULE_DEVICE_TABLE(of, atmel_flexcom_of_match);
-#ifdef CONFIG_PM_SLEEP
-static int atmel_flexcom_resume(struct device *dev)
+static int __maybe_unused atmel_flexcom_resume(struct device *dev)
{
struct atmel_flexcom *ddata = dev_get_drvdata(dev);
int err;
@@ -105,7 +104,6 @@ static int atmel_flexcom_resume(struct device *dev)
return 0;
}
-#endif
static SIMPLE_DEV_PM_OPS(atmel_flexcom_pm_ops, NULL,
atmel_flexcom_resume);
@@ -114,7 +112,7 @@ static struct platform_driver atmel_flexcom_driver = {
.probe = atmel_flexcom_probe,
.driver = {
.name = "atmel_flexcom",
- .pm = &atmel_flexcom_pm_ops,
+ .pm = pm_ptr(&atmel_flexcom_pm_ops),
.of_match_table = atmel_flexcom_of_match,
},
};
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 157/846] mfd: atmel-flexcom: Use .resume_noirq
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 156/846] mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 158/846] bfq: Do not let waker requests skip proper accounting Greg Kroah-Hartman
` (692 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Codrin Ciubotariu,
Nicolas Ferre, Lee Jones, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 5d051cf94fd5834a1513aa77e542c49fd973988a ]
Flexcom IP embeds 3 other IPs: usart, i2c, spi and selects the operation
mode (usart, i2c, spi) via mode register (FLEX_MR). On i2c bus there might
be connected critical devices (like PMIC) which on suspend/resume should
be suspended/resumed at the end/beginning. i2c uses
.suspend_noirq/.resume_noirq for this kind of purposes. Align flexcom
to use .resume_noirq as it should be resumed before the embedded IPs.
Otherwise the embedded devices might behave badly.
Fixes: 7fdec11015c3 ("atmel_flexcom: Support resuming after a chip reset")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Tested-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20211028135138.3481166-3-claudiu.beznea@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/atmel-flexcom.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/mfd/atmel-flexcom.c b/drivers/mfd/atmel-flexcom.c
index 962f66dc8813e..559eb4d352b68 100644
--- a/drivers/mfd/atmel-flexcom.c
+++ b/drivers/mfd/atmel-flexcom.c
@@ -87,7 +87,7 @@ static const struct of_device_id atmel_flexcom_of_match[] = {
};
MODULE_DEVICE_TABLE(of, atmel_flexcom_of_match);
-static int __maybe_unused atmel_flexcom_resume(struct device *dev)
+static int __maybe_unused atmel_flexcom_resume_noirq(struct device *dev)
{
struct atmel_flexcom *ddata = dev_get_drvdata(dev);
int err;
@@ -105,8 +105,9 @@ static int __maybe_unused atmel_flexcom_resume(struct device *dev)
return 0;
}
-static SIMPLE_DEV_PM_OPS(atmel_flexcom_pm_ops, NULL,
- atmel_flexcom_resume);
+static const struct dev_pm_ops atmel_flexcom_pm_ops = {
+ .resume_noirq = atmel_flexcom_resume_noirq,
+};
static struct platform_driver atmel_flexcom_driver = {
.probe = atmel_flexcom_probe,
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 158/846] bfq: Do not let waker requests skip proper accounting
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 157/846] mfd: atmel-flexcom: Use .resume_noirq Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 159/846] libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data Greg Kroah-Hartman
` (691 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Valente, Jan Kara, Jens Axboe,
Sasha Levin
From: Jan Kara <jack@suse.cz>
[ Upstream commit c65e6fd460b4df796ecd6ea22e132076ed1f2820 ]
Commit 7cc4ffc55564 ("block, bfq: put reqs of waker and woken in
dispatch list") added a condition to bfq_insert_request() which added
waker's requests directly to dispatch list. The rationale was that
completing waker's IO is needed to get more IO for the current queue.
Although this rationale is valid, there is a hole in it. The waker does
not necessarily serve the IO only for the current queue and maybe it's
current IO is not needed for current queue to make progress. Furthermore
injecting IO like this completely bypasses any service accounting within
bfq and thus we do not properly track how much service is waker's queue
getting or that the waker is actually doing any IO. Depending on the
conditions this can result in the waker getting too much or too few
service.
Consider for example the following job file:
[global]
directory=/mnt/repro/
rw=write
size=8g
time_based
runtime=30
ramp_time=10
blocksize=1m
direct=0
ioengine=sync
[slowwriter]
numjobs=1
prioclass=2
prio=7
fsync=200
[fastwriter]
numjobs=1
prioclass=2
prio=0
fsync=200
Despite processes have very different IO priorities, they get the same
about of service. The reason is that bfq identifies these processes as
having waker-wakee relationship and once that happens, IO from
fastwriter gets injected during slowwriter's time slice. As a result bfq
is not aware that fastwriter has any IO to do and constantly schedules
only slowwriter's queue. Thus fastwriter is forced to compete with
slowwriter's IO all the time instead of getting its share of time based
on IO priority.
Drop the special injection condition from bfq_insert_request(). As a
result, requests will be tracked and queued in a normal way and on next
dispatch bfq_select_queue() can decide whether the waker's inserted
requests should be injected during the current queue's timeslice or not.
Fixes: 7cc4ffc55564 ("block, bfq: put reqs of waker and woken in dispatch list")
Acked-by: Paolo Valente <paolo.valente@linaro.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20211125133645.27483-8-jack@suse.cz
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/bfq-iosched.c | 44 +-------------------------------------------
1 file changed, 1 insertion(+), 43 deletions(-)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 480e1a1348596..ea9a086d0498f 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -5991,48 +5991,7 @@ static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
spin_lock_irq(&bfqd->lock);
bfqq = bfq_init_rq(rq);
-
- /*
- * Reqs with at_head or passthrough flags set are to be put
- * directly into dispatch list. Additional case for putting rq
- * directly into the dispatch queue: the only active
- * bfq_queues are bfqq and either its waker bfq_queue or one
- * of its woken bfq_queues. The rationale behind this
- * additional condition is as follows:
- * - consider a bfq_queue, say Q1, detected as a waker of
- * another bfq_queue, say Q2
- * - by definition of a waker, Q1 blocks the I/O of Q2, i.e.,
- * some I/O of Q1 needs to be completed for new I/O of Q2
- * to arrive. A notable example of waker is journald
- * - so, Q1 and Q2 are in any respect the queues of two
- * cooperating processes (or of two cooperating sets of
- * processes): the goal of Q1's I/O is doing what needs to
- * be done so that new Q2's I/O can finally be
- * issued. Therefore, if the service of Q1's I/O is delayed,
- * then Q2's I/O is delayed too. Conversely, if Q2's I/O is
- * delayed, the goal of Q1's I/O is hindered.
- * - as a consequence, if some I/O of Q1/Q2 arrives while
- * Q2/Q1 is the only queue in service, there is absolutely
- * no point in delaying the service of such an I/O. The
- * only possible result is a throughput loss
- * - so, when the above condition holds, the best option is to
- * have the new I/O dispatched as soon as possible
- * - the most effective and efficient way to attain the above
- * goal is to put the new I/O directly in the dispatch
- * list
- * - as an additional restriction, Q1 and Q2 must be the only
- * busy queues for this commit to put the I/O of Q2/Q1 in
- * the dispatch list. This is necessary, because, if also
- * other queues are waiting for service, then putting new
- * I/O directly in the dispatch list may evidently cause a
- * violation of service guarantees for the other queues
- */
- if (!bfqq ||
- (bfqq != bfqd->in_service_queue &&
- bfqd->in_service_queue != NULL &&
- bfq_tot_busy_queues(bfqd) == 1 + bfq_bfqq_busy(bfqq) &&
- (bfqq->waker_bfqq == bfqd->in_service_queue ||
- bfqd->in_service_queue->waker_bfqq == bfqq)) || at_head) {
+ if (!bfqq || at_head) {
if (at_head)
list_add(&rq->queuelist, &bfqd->dispatch);
else
@@ -6059,7 +6018,6 @@ static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
* merge).
*/
cmd_flags = rq->cmd_flags;
-
spin_unlock_irq(&bfqd->lock);
bfq_update_insert_stats(q, bfqq, idle_timer_disabled,
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 159/846] libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 158/846] bfq: Do not let waker requests skip proper accounting Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 160/846] media: i2c: imx274: fix s_frame_interval runtime resume not requested Greg Kroah-Hartman
` (690 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Maguire, Andrii Nakryiko, Sasha Levin
From: Alan Maguire <alan.maguire@oracle.com>
[ Upstream commit 43174f0d4597325cb91f1f1f55263eb6e6101036 ]
When compiling libbpf with gcc 4.8.5, we see:
CC staticobjs/btf_dump.o
btf_dump.c: In function ‘btf_dump_dump_type_data.isra.24’:
btf_dump.c:2296:5: error: ‘err’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
if (err < 0)
^
cc1: all warnings being treated as errors
make: *** [staticobjs/btf_dump.o] Error 1
While gcc 4.8.5 is too old to build the upstream kernel, it's possible it
could be used to build standalone libbpf which suffers from the same problem.
Silence the error by initializing 'err' to 0. The warning/error seems to be
a false positive since err is set early in the function. Regardless we
shouldn't prevent libbpf from building for this.
Fixes: 920d16af9b42 ("libbpf: BTF dumper support for typed data")
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/1638180040-8037-1-git-send-email-alan.maguire@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/btf_dump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
index e4b483f15fb99..8c9325802793b 100644
--- a/tools/lib/bpf/btf_dump.c
+++ b/tools/lib/bpf/btf_dump.c
@@ -2186,7 +2186,7 @@ static int btf_dump_dump_type_data(struct btf_dump *d,
__u8 bits_offset,
__u8 bit_sz)
{
- int size, err;
+ int size, err = 0;
size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset);
if (size < 0)
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 160/846] media: i2c: imx274: fix s_frame_interval runtime resume not requested
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 159/846] libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 161/846] media: i2c: Re-order runtime pm initialisation Greg Kroah-Hartman
` (689 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eugen Hristev, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
From: Eugen Hristev <eugen.hristev@microchip.com>
[ Upstream commit da653498c20ba5b185214d8ae43b4e8e9594f520 ]
pm_runtime_resume_and_get should be called when the s_frame_interval
is called.
The driver will try to access device registers to configure VMAX, coarse
time and exposure.
Currently if the runtime is not resumed, this fails:
# media-ctl -d /dev/media0 --set-v4l2 '"IMX274 1-001a":0[fmt:SRGGB10_1X10/3840x2
160@1/10]'
IMX274 1-001a: imx274_binning_goodness: ask 3840x2160, size 3840x2160, goodness 0
IMX274 1-001a: imx274_binning_goodness: ask 3840x2160, size 1920x1080, goodness -3000
IMX274 1-001a: imx274_binning_goodness: ask 3840x2160, size 1280x720, goodness -4000
IMX274 1-001a: imx274_binning_goodness: ask 3840x2160, size 1280x540, goodness -4180
IMX274 1-001a: __imx274_change_compose: selected 1x1 binning
IMX274 1-001a: imx274_set_frame_interval: input frame interval = 1 / 10
IMX274 1-001a: imx274_read_mbreg : addr 0x300e, val=0x1 (2 bytes)
IMX274 1-001a: imx274_set_frame_interval : register SVR = 1
IMX274 1-001a: imx274_read_mbreg : addr 0x30f6, val=0x6a8 (2 bytes)
IMX274 1-001a: imx274_set_frame_interval : register HMAX = 1704
IMX274 1-001a: imx274_set_frame_length : input length = 2112
IMX274 1-001a: imx274_write_mbreg : i2c bulk write failed, 30f8 = 884 (3 bytes)
IMX274 1-001a: imx274_set_frame_length error = -121
IMX274 1-001a: imx274_set_frame_interval error = -121
Unable to setup formats: Remote I/O error (121)
The device is not resumed thus the remote I/O error.
Setting the frame interval works at streaming time, because
pm_runtime_resume_and_get is called at s_stream time before sensor setup.
The failure happens when only the s_frame_interval is called separately
independently on streaming time.
Fixes: ad97bc37426c ("media: i2c: imx274: Add IMX274 power on and off sequence")
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/imx274.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/i2c/imx274.c b/drivers/media/i2c/imx274.c
index 0dce92872176d..4d9b64c61f603 100644
--- a/drivers/media/i2c/imx274.c
+++ b/drivers/media/i2c/imx274.c
@@ -1367,6 +1367,10 @@ static int imx274_s_frame_interval(struct v4l2_subdev *sd,
int min, max, def;
int ret;
+ ret = pm_runtime_resume_and_get(&imx274->client->dev);
+ if (ret < 0)
+ return ret;
+
mutex_lock(&imx274->lock);
ret = imx274_set_frame_interval(imx274, fi->interval);
@@ -1398,6 +1402,7 @@ static int imx274_s_frame_interval(struct v4l2_subdev *sd,
unlock:
mutex_unlock(&imx274->lock);
+ pm_runtime_put(&imx274->client->dev);
return ret;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 161/846] media: i2c: Re-order runtime pm initialisation
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 160/846] media: i2c: imx274: fix s_frame_interval runtime resume not requested Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 162/846] media: i2c: ov8865: Fix lockdep error Greg Kroah-Hartman
` (688 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Scally, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
From: Daniel Scally <djrscally@gmail.com>
[ Upstream commit d2484fbf780762f6f9cc3abb7a07ee42dca2eaa3 ]
The kerneldoc for pm_runtime_set_suspended() says:
"It is not valid to call this function for devices with runtime PM
enabled"
To satisfy that requirement, re-order the calls so that
pm_runtime_enable() is the last one.
Fixes: 11c0d8fdccc5 ("media: i2c: Add support for the OV8865 image sensor")
Signed-off-by: Daniel Scally <djrscally@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov8865.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/i2c/ov8865.c
+++ b/drivers/media/i2c/ov8865.c
@@ -2899,8 +2899,8 @@ static int ov8865_probe(struct i2c_clien
/* Runtime PM */
- pm_runtime_enable(sensor->dev);
pm_runtime_set_suspended(sensor->dev);
+ pm_runtime_enable(sensor->dev);
/* V4L2 subdev register */
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 162/846] media: i2c: ov8865: Fix lockdep error
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 161/846] media: i2c: Re-order runtime pm initialisation Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 163/846] media: rcar-csi2: Correct the selection of hsfreqrange Greg Kroah-Hartman
` (687 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 6e1c9bc9ae96e57bcd8807174f2c0f44f9ef7938 ]
ov8865_state_init() calls ov8865_state_mipi_configure() which uses
__v4l2_ctrl_s_ctrl[_int64](). This means that sensor->mutex (which
is also sensor->ctrls.handler.lock) must be locked before calling
ov8865_state_init().
Note ov8865_state_mipi_configure() is also used in other places where
the lock is already held so it cannot be changed itself.
This fixes the following lockdep kernel WARN:
[ 13.233421] WARNING: CPU: 0 PID: 8 at drivers/media/v4l2-core/v4l2-ctrls-api.c:833 __v4l2_ctrl_s_ctrl+0x4d/0x60 [videodev]
...
[ 13.234063] Call Trace:
[ 13.234074] ov8865_state_configure+0x98b/0xc00 [ov8865]
[ 13.234095] ov8865_probe+0x4b1/0x54c [ov8865]
[ 13.234117] i2c_device_probe+0x13c/0x2d0
Fixes: 11c0d8fdccc5 ("media: i2c: Add support for the OV8865 image sensor")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov8865.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/i2c/ov8865.c
+++ b/drivers/media/i2c/ov8865.c
@@ -2893,7 +2893,9 @@ static int ov8865_probe(struct i2c_clien
if (ret)
goto error_mutex;
+ mutex_lock(&sensor->mutex);
ret = ov8865_state_init(sensor);
+ mutex_unlock(&sensor->mutex);
if (ret)
goto error_ctrls;
^ permalink raw reply [flat|nested] 865+ messages in thread
* [PATCH 5.15 163/846] media: rcar-csi2: Correct the selection of hsfreqrange
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 162/846] media: i2c: ov8865: Fix lockdep error Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 164/846] media: imx-pxp: Initialize the spinlock prior to using it Greg Kroah-Hartman
` (686 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Suresh Udipi, Kazuyoshi Akiyama,
Michael Rodin, Niklas Söderlund, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Suresh Udipi <sudipi@jp.adit-jv.com>
[ Upstream commit cee44d4fbacbbdfe62697ec94e76c6e4f726c5df ]
hsfreqrange should be chosen based on the calculated mbps which
is closer to the default bit rate and within the range as per
table[1]. But current calculation always selects first value which
is greater than or equal to the calculated mbps which may lead
to chosing a wrong range in some cases.
For example for 360 mbps for H3/M3N
Existing logic selects
Calculated value 360Mbps : Default 400Mbps Range [368.125 -433.125 mbps]
This hsfreqrange is out of range.
The logic is changed to get the default value which is closest to the
calculated value [1]
Calculated value 360Mbps : Default 350Mbps Range [320.625 -380.625 mpbs]
[1] specs r19uh0105ej0200-r-car-3rd-generation.pdf [Table 25.9]
Please note that According to Renesas in Table 25.9 the range for
220 default value is corrected as below
|Range (Mbps) | Default Bit rate (Mbps) |
-----------------------------------------------
| 197.125-244.125 | 220 |
-----------------------------------------------
Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiver driver")
Signed-off-by: Suresh Udipi <sudipi@jp.adit-jv.com>
Signed-off-by: Kazuyoshi Akiyama <akiyama@nds-osk.co.jp>
Signed-off-by: Michael Rodin <mrodin@de.adit-jv.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rcar-vin/rcar-csi2.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c
index ba4a380016cc4..3de782a908659 100644
--- a/drivers/media/platform/rcar-vin/rcar-csi2.c
+++ b/drivers/media/platform/rcar-vin/rcar-csi2.c
@@ -445,16 +445,23 @@ static int rcsi2_wait_phy_start(struct rcar_csi2 *priv,
static int rcsi2_set_phypll(struct rcar_csi2 *priv, unsigned int mbps)
{
const struct rcsi2_mbps_reg *hsfreq;
+ const struct rcsi2_mbps_reg *hsfreq_prev = NULL;
- for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps != 0; hsfreq++)
+ for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps != 0; hsfreq++) {
if (hsfreq->mbps >= mbps)
break;
+ hsfreq_prev = hsfreq;
+ }
if (!hsfreq->mbps) {
dev_err(priv->dev, "Unsupported PHY speed (%u Mbps)", mbps);
return -ERANGE;
}
+ if (hsfreq_prev &&
+ ((mbps - hsfreq_prev->mbps) <= (hsfreq->mbps - mbps)))
+ hsfreq = hsfreq_prev;
+
rcsi2_write(priv, PHYPLL_REG, PHYPLL_HSFREQRANGE(hsfreq->reg));
return 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 164/846] media: imx-pxp: Initialize the spinlock prior to using it
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 163/846] media: rcar-csi2: Correct the selection of hsfreqrange Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 165/846] media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() Greg Kroah-Hartman
` (685 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Philipp Zabel,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Fabio Estevam <festevam@denx.de>
[ Upstream commit ed2f97ad4b21072f849cf4ae6645d1f2b1d3f550 ]
After devm_request_threaded_irq() is called there is a chance that an
interrupt may occur before the spinlock is initialized, which will trigger
a kernel oops.
To prevent that, move the initialization of the spinlock prior to
requesting the interrupts.
Fixes: 51abcf7fdb70 ("media: imx-pxp: add i.MX Pixel Pipeline driver")
Signed-off-by: Fabio Estevam <festevam@denx.de>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/imx-pxp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/imx-pxp.c b/drivers/media/platform/imx-pxp.c
index 4321edc0c23d9..8e9c6fee75a48 100644
--- a/drivers/media/platform/imx-pxp.c
+++ b/drivers/media/platform/imx-pxp.c
@@ -1661,6 +1661,8 @@ static int pxp_probe(struct platform_device *pdev)
if (irq < 0)
return irq;
+ spin_lock_init(&dev->irqlock);
+
ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, pxp_irq_handler,
IRQF_ONESHOT, dev_name(&pdev->dev), dev);
if (ret < 0) {
@@ -1678,8 +1680,6 @@ static int pxp_probe(struct platform_device *pdev)
goto err_clk;
}
- spin_lock_init(&dev->irqlock);
-
ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
if (ret)
goto err_clk;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 165/846] media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 164/846] media: imx-pxp: Initialize the spinlock prior to using it Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 166/846] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released Greg Kroah-Hartman
` (684 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit ef054e345ed8c79ce1121a3599b5a2dfd78e57a0 ]
n the 'radio->hdl.error' error handling, ctrl handler allocated by
v4l2_ctrl_new_std() does not released, and caused memory leak as
follows:
unreferenced object 0xffff888033d54200 (size 256):
comm "i2c-si470x-19", pid 909, jiffies 4294914203 (age 8.072s)
hex dump (first 32 bytes):
e8 69 11 03 80 88 ff ff 00 46 d5 33 80 88 ff ff .i.......F.3....
10 42 d5 33 80 88 ff ff 10 42 d5 33 80 88 ff ff .B.3.....B.3....
backtrace:
[<00000000086bd4ed>] __kmalloc_node+0x1eb/0x360
[<00000000bdb68871>] kvmalloc_node+0x66/0x120
[<00000000fac74e4c>] v4l2_ctrl_new+0x7b9/0x1c60 [videodev]
[<00000000693bf940>] v4l2_ctrl_new_std+0x19b/0x270 [videodev]
[<00000000c0cb91bc>] si470x_i2c_probe+0x2d3/0x9a0 [radio_si470x_i2c]
[<0000000056a6f01f>] i2c_device_probe+0x4d8/0xbe0
Fix the error handling path to avoid memory leak.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 8c081b6f9a9b ("media: radio: Critical v4l2 registration...")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index a972c0705ac79..76d39e2e87706 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -368,7 +368,7 @@ static int si470x_i2c_probe(struct i2c_client *client)
if (radio->hdl.error) {
retval = radio->hdl.error;
dev_err(&client->dev, "couldn't register control\n");
- goto err_dev;
+ goto err_all;
}
/* video device initialization */
@@ -463,7 +463,6 @@ static int si470x_i2c_probe(struct i2c_client *client)
return 0;
err_all:
v4l2_ctrl_handler_free(&radio->hdl);
-err_dev:
v4l2_device_unregister(&radio->v4l2_dev);
err_initial:
return retval;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 166/846] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 165/846] media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 167/846] media: hantro: Hook up RK3399 JPEG encoder output Greg Kroah-Hartman
` (683 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dafna Hirschfeld, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
[ Upstream commit 9f89c881bffbdffe4060ffaef3489a2830a6dd9c ]
The func v4l2_m2m_ctx_release waits for currently running jobs
to finish and then stop streaming both queues and frees the buffers.
All this should be done before the call to mtk_vcodec_enc_release
which frees the encoder handler. This fixes null-pointer dereference bug:
[ 638.028076] Mem abort info:
[ 638.030932] ESR = 0x96000004
[ 638.033978] EC = 0x25: DABT (current EL), IL = 32 bits
[ 638.039293] SET = 0, FnV = 0
[ 638.042338] EA = 0, S1PTW = 0
[ 638.045474] FSC = 0x04: level 0 translation fault
[ 638.050349] Data abort info:
[ 638.053224] ISV = 0, ISS = 0x00000004
[ 638.057055] CM = 0, WnR = 0
[ 638.060018] user pgtable: 4k pages, 48-bit VAs, pgdp=000000012b6db000
[ 638.066485] [00000000000001a0] pgd=0000000000000000, p4d=0000000000000000
[ 638.073277] Internal error: Oops: 96000004 [#1] SMP
[ 638.078145] Modules linked in: rfkill mtk_vcodec_dec mtk_vcodec_enc uvcvideo mtk_mdp mtk_vcodec_common videobuf2_dma_contig v4l2_h264 cdc_ether v4l2_mem2mem videobuf2_vmalloc usbnet videobuf2_memops videobuf2_v4l2 r8152 videobuf2_common videodev cros_ec_sensors cros_ec_sensors_core industrialio_triggered_buffer kfifo_buf elan_i2c elants_i2c sbs_battery mc cros_usbpd_charger cros_ec_chardev cros_usbpd_logger crct10dif_ce mtk_vpu fuse ip_tables x_tables ipv6
[ 638.118583] CPU: 0 PID: 212 Comm: kworker/u8:5 Not tainted 5.15.0-06427-g58a1d4dcfc74-dirty #109
[ 638.127357] Hardware name: Google Elm (DT)
[ 638.131444] Workqueue: mtk-vcodec-enc mtk_venc_worker [mtk_vcodec_enc]
[ 638.137974] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 638.144925] pc : vp8_enc_encode+0x34/0x2b0 [mtk_vcodec_enc]
[ 638.150493] lr : venc_if_encode+0xac/0x1b0 [mtk_vcodec_enc]
[ 638.156060] sp : ffff8000124d3c40
[ 638.159364] x29: ffff8000124d3c40 x28: 0000000000000000 x27: 0000000000000000
[ 638.166493] x26: 0000000000000000 x25: ffff0000e7f252d0 x24: ffff8000124d3d58
[ 638.173621] x23: ffff8000124d3d58 x22: ffff8000124d3d60 x21: 0000000000000001
[ 638.180750] x20: ffff80001137e000 x19: 0000000000000000 x18: 0000000000000001
[ 638.187878] x17: 000000040044ffff x16: 00400032b5503510 x15: 0000000000000000
[ 638.195006] x14: ffff8000118536c0 x13: ffff8000ee1da000 x12: 0000000030d4d91d
[ 638.202134] x11: 0000000000000000 x10: 0000000000000980 x9 : ffff8000124d3b20
[ 638.209262] x8 : ffff0000c18d4ea0 x7 : ffff0000c18d44c0 x6 : ffff0000c18d44c0
[ 638.216391] x5 : ffff80000904a3b0 x4 : ffff8000124d3d58 x3 : ffff8000124d3d60
[ 638.223519] x2 : ffff8000124d3d78 x1 : 0000000000000001 x0 : ffff80001137efb8
[ 638.230648] Call trace:
[ 638.233084] vp8_enc_encode+0x34/0x2b0 [mtk_vcodec_enc]
[ 638.238304] venc_if_encode+0xac/0x1b0 [mtk_vcodec_enc]
[ 638.243525] mtk_venc_worker+0x110/0x250 [mtk_vcodec_enc]
[ 638.248918] process_one_work+0x1f8/0x498
[ 638.252923] worker_thread+0x140/0x538
[ 638.256664] kthread+0x148/0x158
[ 638.259884] ret_from_fork+0x10/0x20
[ 638.263455] Code: f90023f9 2a0103f5 aa0303f6 aa0403f8 (f940d277)
[ 638.269538] ---[ end trace e374fc10f8e181f5 ]---
[gst-master] root@debian:~/gst-build# [ 638.019193] Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a0
Fixes: 4e855a6efa547 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
index 45d1870c83dd7..4ced20ca647b1 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
@@ -218,11 +218,11 @@ static int fops_vcodec_release(struct file *file)
mtk_v4l2_debug(1, "[%d] encoder", ctx->id);
mutex_lock(&dev->dev_mutex);
+ v4l2_m2m_ctx_release(ctx->m2m_ctx);
mtk_vcodec_enc_release(ctx);
v4l2_fh_del(&ctx->fh);
v4l2_fh_exit(&ctx->fh);
v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
- v4l2_m2m_ctx_release(ctx->m2m_ctx);
list_del_init(&ctx->list);
kfree(ctx);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 167/846] media: hantro: Hook up RK3399 JPEG encoder output
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 166/846] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 168/846] media: coda: fix CODA960 JPEG encoder buffer overflow Greg Kroah-Hartman
` (682 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Nicolas Dufresne,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit 230d683ae04894933720425c8dead9508a09ebc3 ]
The JPEG encoder found in the Hantro H1 encoder block only produces a
raw entropy-encoded scan. The driver is responsible for building a JPEG
compliant bitstream and placing the entropy-encoded scan in it. Right
now the driver uses a bounce buffer for the hardware to output the raw
scan to.
In commit e765dba11ec2 ("hantro: Move hantro_enc_buf_finish to JPEG
codec_ops.done"), the code that copies the raw scan from the bounce
buffer to the capture buffer was moved, but was only hooked up for the
Hantro H1 (then RK3288) variant. The RK3399 variant was broken,
producing a JPEG bitstream without the scan, and the capture buffer's
.bytesused field unset.
Fix this by duplicating the code that is executed when the JPEG encoder
finishes encoding a frame. As the encoded length is read back from
hardware, and the variants having different register layouts, the
code is duplicated rather than shared.
Fixes: e765dba11ec2 ("hantro: Move hantro_enc_buf_finish to JPEG codec_ops.done")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +-
drivers/staging/media/hantro/hantro_hw.h | 3 ++-
.../media/hantro/rockchip_vpu2_hw_jpeg_enc.c | 17 +++++++++++++++++
drivers/staging/media/hantro/rockchip_vpu_hw.c | 5 +++--
4 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
index 56cf261a8e958..9cd713c02a455 100644
--- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
+++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
@@ -140,7 +140,7 @@ int hantro_h1_jpeg_enc_run(struct hantro_ctx *ctx)
return 0;
}
-void hantro_jpeg_enc_done(struct hantro_ctx *ctx)
+void hantro_h1_jpeg_enc_done(struct hantro_ctx *ctx)
{
struct hantro_dev *vpu = ctx->dev;
u32 bytesused = vepu_read(vpu, H1_REG_STR_BUF_LIMIT) / 8;
diff --git a/drivers/staging/media/hantro/hantro_hw.h b/drivers/staging/media/hantro/hantro_hw.h
index df7b5e3a57b9b..fd738653a5735 100644
--- a/drivers/staging/media/hantro/hantro_hw.h
+++ b/drivers/staging/media/hantro/hantro_hw.h
@@ -235,7 +235,8 @@ int hantro_h1_jpeg_enc_run(struct hantro_ctx *ctx);
int rockchip_vpu2_jpeg_enc_run(struct hantro_ctx *ctx);
int hantro_jpeg_enc_init(struct hantro_ctx *ctx);
void hantro_jpeg_enc_exit(struct hantro_ctx *ctx);
-void hantro_jpeg_enc_done(struct hantro_ctx *ctx);
+void hantro_h1_jpeg_enc_done(struct hantro_ctx *ctx);
+void rockchip_vpu2_jpeg_enc_done(struct hantro_ctx *ctx);
dma_addr_t hantro_h264_get_ref_buf(struct hantro_ctx *ctx,
unsigned int dpb_idx);
diff --git a/drivers/staging/media/hantro/rockchip_vpu2_hw_jpeg_enc.c b/drivers/staging/media/hantro/rockchip_vpu2_hw_jpeg_enc.c
index 991213ce16108..5d9ff420f0b5f 100644
--- a/drivers/staging/media/hantro/rockchip_vpu2_hw_jpeg_enc.c
+++ b/drivers/staging/media/hantro/rockchip_vpu2_hw_jpeg_enc.c
@@ -171,3 +171,20 @@ int rockchip_vpu2_jpeg_enc_run(struct hantro_ctx *ctx)
return 0;
}
+
+void rockchip_vpu2_jpeg_enc_done(struct hantro_ctx *ctx)
+{
+ struct hantro_dev *vpu = ctx->dev;
+ u32 bytesused = vepu_read(vpu, VEPU_REG_STR_BUF_LIMIT) / 8;
+ struct vb2_v4l2_buffer *dst_buf = hantro_get_dst_buf(ctx);
+
+ /*
+ * TODO: Rework the JPEG encoder to eliminate the need
+ * for a bounce buffer.
+ */
+ memcpy(vb2_plane_vaddr(&dst_buf->vb2_buf, 0) +
+ ctx->vpu_dst_fmt->header_size,
+ ctx->jpeg_enc.bounce_buffer.cpu, bytesused);
+ vb2_set_plane_payload(&dst_buf->vb2_buf, 0,
+ ctx->vpu_dst_fmt->header_size + bytesused);
+}
diff --git a/drivers/staging/media/hantro/rockchip_vpu_hw.c b/drivers/staging/media/hantro/rockchip_vpu_hw.c
index d4f52957cc534..0c22039162a00 100644
--- a/drivers/staging/media/hantro/rockchip_vpu_hw.c
+++ b/drivers/staging/media/hantro/rockchip_vpu_hw.c
@@ -343,7 +343,7 @@ static const struct hantro_codec_ops rk3066_vpu_codec_ops[] = {
.run = hantro_h1_jpeg_enc_run,
.reset = rockchip_vpu1_enc_reset,
.init = hantro_jpeg_enc_init,
- .done = hantro_jpeg_enc_done,
+ .done = hantro_h1_jpeg_enc_done,
.exit = hantro_jpeg_enc_exit,
},
[HANTRO_MODE_H264_DEC] = {
@@ -371,7 +371,7 @@ static const struct hantro_codec_ops rk3288_vpu_codec_ops[] = {
.run = hantro_h1_jpeg_enc_run,
.reset = rockchip_vpu1_enc_reset,
.init = hantro_jpeg_enc_init,
- .done = hantro_jpeg_enc_done,
+ .done = hantro_h1_jpeg_enc_done,
.exit = hantro_jpeg_enc_exit,
},
[HANTRO_MODE_H264_DEC] = {
@@ -399,6 +399,7 @@ static const struct hantro_codec_ops rk3399_vpu_codec_ops[] = {
.run = rockchip_vpu2_jpeg_enc_run,
.reset = rockchip_vpu2_enc_reset,
.init = hantro_jpeg_enc_init,
+ .done = rockchip_vpu2_jpeg_enc_done,
.exit = hantro_jpeg_enc_exit,
},
[HANTRO_MODE_H264_DEC] = {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 168/846] media: coda: fix CODA960 JPEG encoder buffer overflow
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 167/846] media: hantro: Hook up RK3399 JPEG encoder output Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 169/846] media: venus: correct low power frequency calculation for encoder Greg Kroah-Hartman
` (681 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin Weber, Philipp Zabel,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Philipp Zabel <p.zabel@pengutronix.de>
[ Upstream commit 1a59cd88f55068710f6549bee548846661673780 ]
Stop the CODA960 JPEG encoder from overflowing capture buffers.
The bitstream buffer overflow interrupt doesn't seem to be connected,
so this has to be handled via timeout instead.
Reported-by: Martin Weber <martin.weber@br-automation.com>
Fixes: 96f6f62c4656 ("media: coda: jpeg: add CODA960 JPEG encoder support")
Tested-by: Martin Weber <martin.weber@br-automation.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/coda/coda-common.c | 8 +++++---
drivers/media/platform/coda/coda-jpeg.c | 21 ++++++++++++++++++++-
2 files changed, 25 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
index 0e312b0842d7f..9a2640a9c75c6 100644
--- a/drivers/media/platform/coda/coda-common.c
+++ b/drivers/media/platform/coda/coda-common.c
@@ -1537,11 +1537,13 @@ static void coda_pic_run_work(struct work_struct *work)
if (!wait_for_completion_timeout(&ctx->completion,
msecs_to_jiffies(1000))) {
- dev_err(dev->dev, "CODA PIC_RUN timeout\n");
+ if (ctx->use_bit) {
+ dev_err(dev->dev, "CODA PIC_RUN timeout\n");
- ctx->hold = true;
+ ctx->hold = true;
- coda_hw_reset(ctx);
+ coda_hw_reset(ctx);
+ }
if (ctx->ops->run_timeout)
ctx->ops->run_timeout(ctx);
diff --git a/drivers/media/platform/coda/coda-jpeg.c b/drivers/media/platform/coda/coda-jpeg.c
index b11cfbe166dd3..a72f4655e5ad5 100644
--- a/drivers/media/platform/coda/coda-jpeg.c
+++ b/drivers/media/platform/coda/coda-jpeg.c
@@ -1127,7 +1127,8 @@ static int coda9_jpeg_prepare_encode(struct coda_ctx *ctx)
coda_write(dev, 0, CODA9_REG_JPEG_GBU_BT_PTR);
coda_write(dev, 0, CODA9_REG_JPEG_GBU_WD_PTR);
coda_write(dev, 0, CODA9_REG_JPEG_GBU_BBSR);
- coda_write(dev, 0, CODA9_REG_JPEG_BBC_STRM_CTRL);
+ coda_write(dev, BIT(31) | ((end_addr - start_addr - header_len) / 256),
+ CODA9_REG_JPEG_BBC_STRM_CTRL);
coda_write(dev, 0, CODA9_REG_JPEG_GBU_CTRL);
coda_write(dev, 0, CODA9_REG_JPEG_GBU_FF_RPTR);
coda_write(dev, 127, CODA9_REG_JPEG_GBU_BBER);
@@ -1257,6 +1258,23 @@ static void coda9_jpeg_finish_encode(struct coda_ctx *ctx)
coda_hw_reset(ctx);
}
+static void coda9_jpeg_encode_timeout(struct coda_ctx *ctx)
+{
+ struct coda_dev *dev = ctx->dev;
+ u32 end_addr, wr_ptr;
+
+ /* Handle missing BBC overflow interrupt via timeout */
+ end_addr = coda_read(dev, CODA9_REG_JPEG_BBC_END_ADDR);
+ wr_ptr = coda_read(dev, CODA9_REG_JPEG_BBC_WR_PTR);
+ if (wr_ptr >= end_addr - 256) {
+ v4l2_err(&dev->v4l2_dev, "JPEG too large for capture buffer\n");
+ coda9_jpeg_finish_encode(ctx);
+ return;
+ }
+
+ coda_hw_reset(ctx);
+}
+
static void coda9_jpeg_release(struct coda_ctx *ctx)
{
int i;
@@ -1276,6 +1294,7 @@ const struct coda_context_ops coda9_jpeg_encode_ops = {
.start_streaming = coda9_jpeg_start_encoding,
.prepare_run = coda9_jpeg_prepare_encode,
.finish_run = coda9_jpeg_finish_encode,
+ .run_timeout = coda9_jpeg_encode_timeout,
.release = coda9_jpeg_release,
};
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 169/846] media: venus: correct low power frequency calculation for encoder
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 168/846] media: coda: fix CODA960 JPEG encoder buffer overflow Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 170/846] media: venus: core: Fix a potential NULL pointer dereference in an error handling path Greg Kroah-Hartman
` (680 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mansur Alisha Shaik,
Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin
From: Mansur Alisha Shaik <mansur@codeaurora.org>
[ Upstream commit b1f9bb8020783a48151e3a2864fbdc70548566dd ]
In exististing implimentation, in min_loaded_core() for low_power
vpp frequency value is considering as vpp_freq instead of low_power_freq.
Fixed this by correcting vpp frequency calculation for encoder.
Fixes: 3cfe5815ce0e (media: venus: Enable low power setting for encoder)
Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/pm_helpers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c
index e031fd17f4e75..d382872bc8a08 100644
--- a/drivers/media/platform/qcom/venus/pm_helpers.c
+++ b/drivers/media/platform/qcom/venus/pm_helpers.c
@@ -587,8 +587,8 @@ min_loaded_core(struct venus_inst *inst, u32 *min_coreid, u32 *min_load, bool lo
if (inst->session_type == VIDC_SESSION_TYPE_DEC)
vpp_freq = inst_pos->clk_data.vpp_freq;
else if (inst->session_type == VIDC_SESSION_TYPE_ENC)
- vpp_freq = low_power ? inst_pos->clk_data.vpp_freq :
- inst_pos->clk_data.low_power_freq;
+ vpp_freq = low_power ? inst_pos->clk_data.low_power_freq :
+ inst_pos->clk_data.vpp_freq;
else
continue;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 170/846] media: venus: core: Fix a potential NULL pointer dereference in an error handling path
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 169/846] media: venus: correct low power frequency calculation for encoder Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 171/846] media: venus: core: Fix a resource leak in the error handling path of venus_probe() Greg Kroah-Hartman
` (679 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit e4debea9be7d5db52bc6a565a4c02c3c6560d093 ]
The normal path of the function makes the assumption that
'pm_ops->core_power' may be NULL.
We should make the same assumption in the error handling path or a NULL
pointer dereference may occur.
Add the missing test before calling 'pm_ops->core_power'
Fixes: 9e8efdb57879 ("media: venus: core: vote for video-mem path")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 91b15842c5558..84cd92628cfdc 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -472,7 +472,8 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
err_video_path:
icc_set_bw(core->cpucfg_path, kbps_to_icc(1000), 0);
err_cpucfg_path:
- pm_ops->core_power(core, POWER_ON);
+ if (pm_ops->core_power)
+ pm_ops->core_power(core, POWER_ON);
return ret;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 171/846] media: venus: core: Fix a resource leak in the error handling path of venus_probe()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 170/846] media: venus: core: Fix a potential NULL pointer dereference in an error handling path Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 172/846] net: stmmac: Add platform level debug register dump feature Greg Kroah-Hartman
` (678 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 8cc7a1b2aca067397a016cdb971a5e6ad9b640c7 ]
A successful 'of_platform_populate()' call should be balanced by a
corresponding 'of_platform_depopulate()' call in the error handling path
of the probe, as already done in the remove function.
A successful 'venus_firmware_init()' call should be balanced by a
corresponding 'venus_firmware_deinit()' call in the error handling path
of the probe, as already done in the remove function.
Update the error handling path accordingly.
Fixes: f9799fcce4bb ("media: venus: firmware: register separate platform_device for firmware loader")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/core.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 84cd92628cfdc..1f0181b6353c9 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -349,11 +349,11 @@ static int venus_probe(struct platform_device *pdev)
ret = venus_firmware_init(core);
if (ret)
- goto err_runtime_disable;
+ goto err_of_depopulate;
ret = venus_boot(core);
if (ret)
- goto err_runtime_disable;
+ goto err_firmware_deinit;
ret = hfi_core_resume(core, true);
if (ret)
@@ -385,6 +385,10 @@ err_dev_unregister:
v4l2_device_unregister(&core->v4l2_dev);
err_venus_shutdown:
venus_shutdown(core);
+err_firmware_deinit:
+ venus_firmware_deinit(core);
+err_of_depopulate:
+ of_platform_depopulate(dev);
err_runtime_disable:
pm_runtime_put_noidle(dev);
pm_runtime_set_suspended(dev);
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 172/846] net: stmmac: Add platform level debug register dump feature
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 171/846] media: venus: core: Fix a resource leak in the error handling path of venus_probe() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 173/846] thermal/drivers/imx: Implement runtime PM support Greg Kroah-Hartman
` (677 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joakim Zhang, David S. Miller,
Bhupesh Sharma, Sasha Levin
From: Bhupesh Sharma <bhupesh.sharma@linaro.org>
[ Upstream commit 4047b9db1aa7512a10ba3560a3f63821c8c40235 ]
dwmac-qcom-ethqos currently exposes a mechanism to dump rgmii registers
after the 'stmmac_dvr_probe()' returns. However with commit
5ec55823438e ("net: stmmac: add clocks management for gmac driver"),
we now let 'pm_runtime_put()' disable the clocks before returning from
'stmmac_dvr_probe()'.
This causes a crash when 'rgmii_dump()' register dumps are enabled,
as the clocks are already off.
Since other dwmac drivers (possible future users as well) might
require a similar register dump feature, introduce a platform level
callback to allow the same.
This fixes the crash noticed while enabling rgmii_dump() dumps in
dwmac-qcom-ethqos driver as well. It also allows future changes
to keep a invoking the register dump callback from the correct
place inside 'stmmac_dvr_probe()'.
Fixes: 5ec55823438e ("net: stmmac: add clocks management for gmac driver")
Cc: Joakim Zhang <qiangqing.zhang@nxp.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Bhupesh Sharma <bhupesh.sharma@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 7 ++++---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +++
include/linux/stmmac.h | 1 +
3 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
index 5c74b6279d690..6b1d9e8879f46 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
@@ -113,8 +113,10 @@ static void rgmii_updatel(struct qcom_ethqos *ethqos,
rgmii_writel(ethqos, temp, offset);
}
-static void rgmii_dump(struct qcom_ethqos *ethqos)
+static void rgmii_dump(void *priv)
{
+ struct qcom_ethqos *ethqos = priv;
+
dev_dbg(ðqos->pdev->dev, "Rgmii register dump\n");
dev_dbg(ðqos->pdev->dev, "RGMII_IO_MACRO_CONFIG: %x\n",
rgmii_readl(ethqos, RGMII_IO_MACRO_CONFIG));
@@ -499,6 +501,7 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
plat_dat->bsp_priv = ethqos;
plat_dat->fix_mac_speed = ethqos_fix_mac_speed;
+ plat_dat->dump_debug_regs = rgmii_dump;
plat_dat->has_gmac4 = 1;
plat_dat->pmt = 1;
plat_dat->tso_en = of_property_read_bool(np, "snps,tso");
@@ -507,8 +510,6 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
if (ret)
goto err_clk;
- rgmii_dump(ethqos);
-
return ret;
err_clk:
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 3422f0746d825..06e5431cf51df 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -7077,6 +7077,9 @@ int stmmac_dvr_probe(struct device *device,
stmmac_init_fs(ndev);
#endif
+ if (priv->plat->dump_debug_regs)
+ priv->plat->dump_debug_regs(priv->plat->bsp_priv);
+
/* Let pm_runtime_put() disable the clocks.
* If CONFIG_PM is not enabled, the clocks will stay powered.
*/
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index a6f03b36fc4f7..1450397fc0bcd 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -233,6 +233,7 @@ struct plat_stmmacenet_data {
int (*clks_config)(void *priv, bool enabled);
int (*crosststamp)(ktime_t *device, struct system_counterval_t *system,
void *ctx);
+ void (*dump_debug_regs)(void *priv);
void *bsp_priv;
struct clk *stmmac_clk;
struct clk *pclk;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 173/846] thermal/drivers/imx: Implement runtime PM support
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 172/846] net: stmmac: Add platform level debug register dump feature Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 174/846] igc: AF_XDP zero-copy metadata adjust breaks SKBs on XDP_PASS Greg Kroah-Hartman
` (676 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleksij Rempel, Petr Beneš,
Daniel Lezcano, Sasha Levin
From: Oleksij Rempel <o.rempel@pengutronix.de>
[ Upstream commit 4cf2ddf16e175ee18c5c29865c32da7d6269cf44 ]
Starting with commit d92ed2c9d3ff ("thermal: imx: Use driver's local
data to decide whether to run a measurement") this driver stared using
irq_enabled flag to make decision to power on/off the thermal
core. This triggered a regression, where after reaching critical
temperature, alarm IRQ handler set irq_enabled to false, disabled
thermal core and was not able read temperature and disable cooling
sequence.
In case the cooling device is "CPU/GPU freq", the system will run with
reduce performance until next reboot.
To solve this issue, we need to move all parts implementing hand made
runtime power management and let it handle actual runtime PM framework.
Fixes: d92ed2c9d3ff ("thermal: imx: Use driver's local data to decide whether to run a measurement")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Tested-by: Petr Beneš <petr.benes@ysoft.com>
Link: https://lore.kernel.org/r/20211117103426.81813-1-o.rempel@pengutronix.de
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/imx_thermal.c | 145 +++++++++++++++++++++-------------
1 file changed, 91 insertions(+), 54 deletions(-)
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index 2c7473d86a59b..16663373b6829 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -15,6 +15,7 @@
#include <linux/regmap.h>
#include <linux/thermal.h>
#include <linux/nvmem-consumer.h>
+#include <linux/pm_runtime.h>
#define REG_SET 0x4
#define REG_CLR 0x8
@@ -194,6 +195,7 @@ static struct thermal_soc_data thermal_imx7d_data = {
};
struct imx_thermal_data {
+ struct device *dev;
struct cpufreq_policy *policy;
struct thermal_zone_device *tz;
struct thermal_cooling_device *cdev;
@@ -252,44 +254,15 @@ static int imx_get_temp(struct thermal_zone_device *tz, int *temp)
const struct thermal_soc_data *soc_data = data->socdata;
struct regmap *map = data->tempmon;
unsigned int n_meas;
- bool wait, run_measurement;
u32 val;
+ int ret;
- run_measurement = !data->irq_enabled;
- if (!run_measurement) {
- /* Check if a measurement is currently in progress */
- regmap_read(map, soc_data->temp_data, &val);
- wait = !(val & soc_data->temp_valid_mask);
- } else {
- /*
- * Every time we measure the temperature, we will power on the
- * temperature sensor, enable measurements, take a reading,
- * disable measurements, power off the temperature sensor.
- */
- regmap_write(map, soc_data->sensor_ctrl + REG_CLR,
- soc_data->power_down_mask);
- regmap_write(map, soc_data->sensor_ctrl + REG_SET,
- soc_data->measure_temp_mask);
-
- wait = true;
- }
-
- /*
- * According to the temp sensor designers, it may require up to ~17us
- * to complete a measurement.
- */
- if (wait)
- usleep_range(20, 50);
+ ret = pm_runtime_resume_and_get(data->dev);
+ if (ret < 0)
+ return ret;
regmap_read(map, soc_data->temp_data, &val);
- if (run_measurement) {
- regmap_write(map, soc_data->sensor_ctrl + REG_CLR,
- soc_data->measure_temp_mask);
- regmap_write(map, soc_data->sensor_ctrl + REG_SET,
- soc_data->power_down_mask);
- }
-
if ((val & soc_data->temp_valid_mask) == 0) {
dev_dbg(&tz->device, "temp measurement never finished\n");
return -EAGAIN;
@@ -328,6 +301,8 @@ static int imx_get_temp(struct thermal_zone_device *tz, int *temp)
enable_irq(data->irq);
}
+ pm_runtime_put(data->dev);
+
return 0;
}
@@ -335,24 +310,16 @@ static int imx_change_mode(struct thermal_zone_device *tz,
enum thermal_device_mode mode)
{
struct imx_thermal_data *data = tz->devdata;
- struct regmap *map = data->tempmon;
- const struct thermal_soc_data *soc_data = data->socdata;
if (mode == THERMAL_DEVICE_ENABLED) {
- regmap_write(map, soc_data->sensor_ctrl + REG_CLR,
- soc_data->power_down_mask);
- regmap_write(map, soc_data->sensor_ctrl + REG_SET,
- soc_data->measure_temp_mask);
+ pm_runtime_get(data->dev);
if (!data->irq_enabled) {
data->irq_enabled = true;
enable_irq(data->irq);
}
} else {
- regmap_write(map, soc_data->sensor_ctrl + REG_CLR,
- soc_data->measure_temp_mask);
- regmap_write(map, soc_data->sensor_ctrl + REG_SET,
- soc_data->power_down_mask);
+ pm_runtime_put(data->dev);
if (data->irq_enabled) {
disable_irq(data->irq);
@@ -393,6 +360,11 @@ static int imx_set_trip_temp(struct thermal_zone_device *tz, int trip,
int temp)
{
struct imx_thermal_data *data = tz->devdata;
+ int ret;
+
+ ret = pm_runtime_resume_and_get(data->dev);
+ if (ret < 0)
+ return ret;
/* do not allow changing critical threshold */
if (trip == IMX_TRIP_CRITICAL)
@@ -406,6 +378,8 @@ static int imx_set_trip_temp(struct thermal_zone_device *tz, int trip,
imx_set_alarm_temp(data, temp);
+ pm_runtime_put(data->dev);
+
return 0;
}
@@ -681,6 +655,8 @@ static int imx_thermal_probe(struct platform_device *pdev)
if (!data)
return -ENOMEM;
+ data->dev = &pdev->dev;
+
map = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, "fsl,tempmon");
if (IS_ERR(map)) {
ret = PTR_ERR(map);
@@ -800,6 +776,16 @@ static int imx_thermal_probe(struct platform_device *pdev)
data->socdata->power_down_mask);
regmap_write(map, data->socdata->sensor_ctrl + REG_SET,
data->socdata->measure_temp_mask);
+ /* After power up, we need a delay before first access can be done. */
+ usleep_range(20, 50);
+
+ /* the core was configured and enabled just before */
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(data->dev);
+
+ ret = pm_runtime_resume_and_get(data->dev);
+ if (ret < 0)
+ goto disable_runtime_pm;
data->irq_enabled = true;
ret = thermal_zone_device_enable(data->tz);
@@ -814,10 +800,15 @@ static int imx_thermal_probe(struct platform_device *pdev)
goto thermal_zone_unregister;
}
+ pm_runtime_put(data->dev);
+
return 0;
thermal_zone_unregister:
thermal_zone_device_unregister(data->tz);
+disable_runtime_pm:
+ pm_runtime_put_noidle(data->dev);
+ pm_runtime_disable(data->dev);
clk_disable:
clk_disable_unprepare(data->thermal_clk);
legacy_cleanup:
@@ -829,13 +820,9 @@ legacy_cleanup:
static int imx_thermal_remove(struct platform_device *pdev)
{
struct imx_thermal_data *data = platform_get_drvdata(pdev);
- struct regmap *map = data->tempmon;
- /* Disable measurements */
- regmap_write(map, data->socdata->sensor_ctrl + REG_SET,
- data->socdata->power_down_mask);
- if (!IS_ERR(data->thermal_clk))
- clk_disable_unprepare(data->thermal_clk);
+ pm_runtime_put_noidle(data->dev);
+ pm_runtime_disable(data->dev);
thermal_zone_device_unregister(data->tz);
imx_thermal_unregister_legacy_cooling(data);
@@ -858,29 +845,79 @@ static int __maybe_unused imx_thermal_suspend(struct device *dev)
ret = thermal_zone_device_disable(data->tz);
if (ret)
return ret;
+
+ return pm_runtime_force_suspend(data->dev);
+}
+
+static int __maybe_unused imx_thermal_resume(struct device *dev)
+{
+ struct imx_thermal_data *data = dev_get_drvdata(dev);
+ int ret;
+
+ ret = pm_runtime_force_resume(data->dev);
+ if (ret)
+ return ret;
+ /* Enabled thermal sensor after resume */
+ return thermal_zone_device_enable(data->tz);
+}
+
+static int __maybe_unused imx_thermal_runtime_suspend(struct device *dev)
+{
+ struct imx_thermal_data *data = dev_get_drvdata(dev);
+ const struct thermal_soc_data *socdata = data->socdata;
+ struct regmap *map = data->tempmon;
+ int ret;
+
+ ret = regmap_write(map, socdata->sensor_ctrl + REG_CLR,
+ socdata->measure_temp_mask);
+ if (ret)
+ return ret;
+
+ ret = regmap_write(map, socdata->sensor_ctrl + REG_SET,
+ socdata->power_down_mask);
+ if (ret)
+ return ret;
+
clk_disable_unprepare(data->thermal_clk);
return 0;
}
-static int __maybe_unused imx_thermal_resume(struct device *dev)
+static int __maybe_unused imx_thermal_runtime_resume(struct device *dev)
{
struct imx_thermal_data *data = dev_get_drvdata(dev);
+ const struct thermal_soc_data *socdata = data->socdata;
+ struct regmap *map = data->tempmon;
int ret;
ret = clk_prepare_enable(data->thermal_clk);
if (ret)
return ret;
- /* Enabled thermal sensor after resume */
- ret = thermal_zone_device_enable(data->tz);
+
+ ret = regmap_write(map, socdata->sensor_ctrl + REG_CLR,
+ socdata->power_down_mask);
+ if (ret)
+ return ret;
+
+ ret = regmap_write(map, socdata->sensor_ctrl + REG_SET,
+ socdata->measure_temp_mask);
if (ret)
return ret;
+ /*
+ * According to the temp sensor designers, it may require up to ~17us
+ * to complete a measurement.
+ */
+ usleep_range(20, 50);
+
return 0;
}
-static SIMPLE_DEV_PM_OPS(imx_thermal_pm_ops,
- imx_thermal_suspend, imx_thermal_resume);
+static const struct dev_pm_ops imx_thermal_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(imx_thermal_suspend, imx_thermal_resume)
+ SET_RUNTIME_PM_OPS(imx_thermal_runtime_suspend,
+ imx_thermal_runtime_resume, NULL)
+};
static struct platform_driver imx_thermal = {
.driver = {
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 174/846] igc: AF_XDP zero-copy metadata adjust breaks SKBs on XDP_PASS
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 173/846] thermal/drivers/imx: Implement runtime PM support Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 175/846] netfilter: bridge: add support for pppoe filtering Greg Kroah-Hartman
` (675 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jesper Dangaard Brouer,
Nechama Kraus, Maciej Fijalkowski, Tony Nguyen, Sasha Levin
From: Jesper Dangaard Brouer <brouer@redhat.com>
[ Upstream commit 4fa8fcd3440101dbacf4fae91de69877ef751977 ]
Driver already implicitly supports XDP metadata access in AF_XDP
zero-copy mode, as xsk_buff_pool's xp_alloc() naturally set xdp_buff
data_meta equal data.
This works fine for XDP and AF_XDP, but if a BPF-prog adjust via
bpf_xdp_adjust_meta() and choose to call XDP_PASS, then igc function
igc_construct_skb_zc() will construct an invalid SKB packet. The
function correctly include the xdp->data_meta area in the memcpy, but
forgot to pull header to take metasize into account.
Fixes: fc9df2a0b520 ("igc: Enable RX via AF_XDP zero-copy")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Tested-by: Nechama Kraus <nechamax.kraus@linux.intel.com>
Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igc/igc_main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 0a96627391a8c..c7fa978cdf02e 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -2447,8 +2447,10 @@ static struct sk_buff *igc_construct_skb_zc(struct igc_ring *ring,
skb_reserve(skb, xdp->data_meta - xdp->data_hard_start);
memcpy(__skb_put(skb, totalsize), xdp->data_meta, totalsize);
- if (metasize)
+ if (metasize) {
skb_metadata_set(skb, metasize);
+ __skb_pull(skb, metasize);
+ }
return skb;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 175/846] netfilter: bridge: add support for pppoe filtering
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 174/846] igc: AF_XDP zero-copy metadata adjust breaks SKBs on XDP_PASS Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 176/846] powerpc: Avoid discarding flags in system_call_exception() Greg Kroah-Hartman
` (674 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin, Amish Chana
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ]
This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for
bridged traffic.
Looking at the original commit it doesn't appear this ever worked:
static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
[..]
if (skb->protocol == htons(ETH_P_8021Q)) {
skb_pull(skb, VLAN_HLEN);
skb->network_header += VLAN_HLEN;
+ } else if (skb->protocol == htons(ETH_P_PPP_SES)) {
+ skb_pull(skb, PPPOE_SES_HLEN);
+ skb->network_header += PPPOE_SES_HLEN;
}
[..]
NF_HOOK(... POST_ROUTING, ...)
... but the adjusted offsets are never restored.
The alternative would be to rip this code out for good,
but otoh we'd have to keep this anyway for the vlan handling
(which works because vlan tag info is in the skb, not the packet
payload).
Reported-and-tested-by: Amish Chana <amish@3g.co.za>
Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 encapsulated in pppoe traffic")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_netfilter_hooks.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 8edfb98ae1d58..68c0d0f928908 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -743,6 +743,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
mtu = nf_bridge->frag_max_size;
+ nf_bridge_update_protocol(skb);
+ nf_bridge_push_encap_header(skb);
+
if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
nf_bridge_info_free(skb);
return br_dev_queue_push_xmit(net, sk, skb);
@@ -760,8 +763,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
- nf_bridge_update_protocol(skb);
-
data = this_cpu_ptr(&brnf_frag_data_storage);
if (skb_vlan_tag_present(skb)) {
@@ -789,8 +790,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
- nf_bridge_update_protocol(skb);
-
data = this_cpu_ptr(&brnf_frag_data_storage);
data->encap_size = nf_bridge_encap_header_len(skb);
data->size = ETH_HLEN + data->encap_size;
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 176/846] powerpc: Avoid discarding flags in system_call_exception()
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 175/846] netfilter: bridge: add support for pppoe filtering Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 177/846] arm64: dts: qcom: msm8916: fix MMC controller aliases Greg Kroah-Hartman
` (673 subsequent siblings)
849 siblings, 0 replies; 865+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Thomas Gleixner,
Eirik Fuller, Michael Ellerman, Nicholas Piggin, Sasha Levin
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit 08b0af5b2affbe7419853e8dd1330e4b3fe27125 ]
Some thread flags can be set remotely, and so even when IRQs are disabled,
the flags can change under our feet. Thus, when setting flags we must use
an atomic operation rather than a plain read-modify-write sequence, as a
plain read-modify-write may discard flags which are concurrently set by a
remote thread, e.g.
// task A // task B
tmp = A->thread_info.flags;
set_tsk_thread_flag(A, NEWFLAG_B);
tmp |= NEWFLAG_A;
A->thread_info.flags = tmp;
arch/powerpc/kernel/interrupt.c's system_call_exception() sets
_TIF_RESTOREALL in the thread info flags with a read-modify-write, which
may result in other flags being discarded.
Elsewhere in the file it uses clear_bits() to atomically remove flag bits,
so use set_bits() here for consistency with those.
There may be reasons (e.g. instrumentation) that prevent the use of
set_thread_flag() and clear_thread_flag() here, which would otherwise be
preferable.
Fixes: ae7aaecc3f2f78b7 ("powerpc/64s: system call rfscv workaround for TM bugs")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Eirik Fuller <efuller@redhat.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Link: https://lore.kernel.org/r/20211129130653.2037928-10-mark.rutland@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/interrupt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kernel/interrupt.c b/arch/powerpc/kernel/interrupt.c
index 835b626cd4760..df048e331cbfe 100644
--- a/arch/powerpc/kernel/interrupt.c
+++ b/arch/powerpc/kernel/interrupt.c
@@ -148,7 +148,7 @@ notrace long system_call_exception(long r3, long r4, long r5,
*/
if (IS_ENABLED(CONFIG_PPC_TRANSACTIONAL_MEM) &&
unlikely(MSR_TM_TRANSACTIONAL(regs->msr)))
- current_thread_info()->flags |= _TIF_RESTOREALL;
+ set_bits(_TIF_RESTOREALL, ¤t_thread_info()->flags);
/*
* If the system call was made with a transaction active, doom it and
--
2.34.1
^ permalink raw reply related [flat|nested] 865+ messages in thread
* [PATCH 5.15 177/846] arm64: dts: qcom: msm8916: fix MMC controller aliases
2022-01-24 18:31 [PATCH 5.15 000/846] 5.15.17-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2022-01-24 18:34 ` [PATCH 5.15 176/846] powerpc: Avoid discarding flags in system_call_exception() Greg Kroah-Hartman
@ 2022-01-24 18:34 ` Greg Kroah-Hartman
2022-01-24 18:34 ` [PATCH 5.15 178/846] drm/vmwgfx: Remove the deprecated lower mem limit Greg